CVE-2026-18372— CSS injection in M-Files Web
Quick assessment
Affected
M-Files Corporation M-Files Web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
M-Files Web（版本低于 26.8.16330.2）中存在 CSS 注入漏洞，该漏洞允许已认证的金库管理员注入任意 CSS 代码，从而影响其他金库用户所查看的 Web 用户界面。
Possible ATT&CK Techniques 1 AI
T1133 · External Remote ServicesAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| M-Files Corporation | M-Files Web | < 26.8.16330.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18372
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CSS injection in M-Files Web
Source: CVE Program / CVE List V5
Vulnerability Description
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| M-Files Corporation | M-Files Web | 0 ~ 26.8.16330.2 | - |
|
II. Public POCs for CVE-2026-18372
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18372
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18372 (1)
-
🔗 Security Advisory: CVE-2026-18372 vendor-advisory
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-78391
Stored Cross-Site Scripting via Untrusted Cryptocurrency Add -
CVE-2026-17033
CVE-2026-17033 CVE Record -
CVE-2026-66610
WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) v -
CVE-2026-32476
WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cr -
CVE-2026-28166
WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting
V. Comments for CVE-2026-18372
No comments yet