CVE-2026-18372

MediumCVSS 4.8

Published: 19/08/2026(UTC)Updated: 22/10/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

CSS injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated vault administrator can inject arbitrary CSS, affecting the web UI shown to other vault users.

Risk Assessment

Risk of altering the interface appearance for other users, potentially leading to phishing or misleading content.

Recommendation

Update M-Files Web to version 26.8.16330.2 or later to fix the vulnerability.

Other vulnerabilities in M-Files Web

CVE-2026-18371Medium
HTML injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated attacker can affect web UI contents displayed to other users.

Original NVD description (English source)

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS