CVE-2023-5524

M-Files Web Companion allows Remote Code Execution for some filetypes

State: Published
Severity: 8.2 High
Published: Oct 20, 2023
Updated: Feb 23, 2026
Reserved: Oct 11, 2023

Description

Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows

Remote Code Execution

via specific file types

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	M-Files Corporation

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
Web CompanionM-Files	23.3 to before 23.10Affected 23.8 LTS SR1Not affected

References

https://product.m-files.com/security-advisories/cve-2023-5524/vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2023-5524vendor-advisory
https://www.m-files.com/about/trust-center/security-advisories/cve-2023-5524/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.