CVE-2025-2159 MEDIUM

CVE-2025-2159: Stored XSS in M-Files Admin user interface

Vendor M-Files Corporation
Product M-Files Admin
Weakness CWE-79 · XSS
Published April 4, 2025
Last update February 23, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI

Key dates

02Disclosure timeline

April 4, 2025 CVE published
February 23, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-47669 WordPress CBX Map for Google Map & OpenStreetMap plugin <= 1.1.12 - Cross Site Scripting (XSS) Vulnerability CVE-2025-15064 Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets CVE-2025-24706 WordPress MultiVendorX plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability CVE-2024-43155 WordPress ComboBlocks plugin <= 2.2.86 - Cross Site Scripting (XSS) vulnerability CVE-2025-11814 Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting