CVE-2025-2091 | THREATINT

Description

An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs.

Reserved 2025-03-07 | Published 2025-06-16 | Updated 2025-06-16 | Assigner M-Files Corporation

MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/RE:M/U:Green

Problem types

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Product status

Default status

unaffected

Any version before 25.6.0

affected

Credits

Pasi Orovuo / Solita Oy finder

Teemu Laakso / Solita Oy finder

References

product.m-files.com/security-advisories/cve-2025-2091

cve.org (CVE-2025-2091)

nvd.nist.gov (CVE-2025-2091)

Download JSON