CVE-2026-18371

MediumCVSS 5.1

Published: 19/08/2026(UTC)Updated: 22/10/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

HTML injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated attacker can affect web UI contents displayed to other users.

Risk Assessment

Risk of displaying malicious content to other users, potentially leading to data theft or phishing.

Recommendation

Update M-Files Web to version 26.8.16330.2 or later to fix the vulnerability.

Other vulnerabilities in M-Files Web

CVE-2026-18372Medium
CSS injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated vault administrator can inject arbitrary CSS, affecting the web UI shown to other vault users.

Original NVD description (English source)

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS