Technical impact
The vulnerability allows an unauthenticated external actor to trigger the M‑Files Server to send arbitrary HTTP GET requests, enabling the server to access internal or external resources that may contain sensitive data. Because the request originates from the server, the attacker gains a gateway to internal systems or external services, potentially exposing confidential information or facilitating further attacks. The flaw is a classic blind SSRF represented by CWE‑918.
Affected Systems
M‑Files Server before version 26.3, used by organizations deploying document co‑authoring features. The legacy co‑authoring connection methods present this weakness for all installations running these pre‑26.3 releases.
Risk and Exploitability
The CVSS score of 6.9 reflects moderate severity; the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild, and the vulnerability is not part of the CISA KEV catalog. Nonetheless, the flaw can be abused remotely without authentication, exploiting network connectivity from the server to arbitrary URLs. The attack vector is inferred to be network‑based, in line with the description of an unauthenticated caller inducing outbound traffic.
