An HTML injection flaw exists in M‑Files Web prior to version 26.8.16330.2. The flaw permits an authenticated user to insert arbitrary HTML fragments into webpages that are rendered for other users. This can lead to the display of malicious or misleading interface elements, which may be exploited for phishing or social engineering. The vulnerability is a classic untrusted input flaw (CWE‑79) and the injected HTML may contain script tags that execute arbitrary JavaScript on the victim’s browser, enabling phishing or other client‑side attacks.

M‑Files Corporation’s M‑Files Web product is affected. All deployments running a version earlier than 26.8.16330.2 are vulnerable. The issue has been identified only for the web interface component of the product.

CVSS score of 5.1 indicates a moderate risk level. The EPSS score of <1% indicates a very low probability of exploitation, and the entry is not listed in the CISA KEV catalog. The bug requires valid user credentials and access to the M‑Files Web portal, so an attacker must first authenticate. Once authenticated, the attacker can target other logged‑in users by injecting HTML into pages they view, potentially facilitating phishing or unauthorized interface changes. No damage to underlying systems is reported, but the threat to user trust and potential social engineering remains.