CVE-2021-41810

Script injection in M-Files Admin

State: Published
Severity: 5.2 Medium
Published: May 2, 2022
Updated: Feb 23, 2026
Reserved: Sep 29, 2021

Description

Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable

Scores

CVSS	Score	Vector	Source
3.1	5.2 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N	M-Files Corporation

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
M-Files ServerM-Files Corporation	M-Files Server to before 22.2.11051.0Affected

References

https://www.m-files.com/about/trust-center/security-advisories/cve-2021-41810/
https://product.m-files.com/security-advisories/cve-2021-41810/vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2021-41810vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.