M-Files Server Denial-of-Service Vulnerability via Database Driver Configuration Change

A denial-of-service vulnerability has been identified in M-Files Server versions prior to 25.1.14445.5 and before 24.8 LTS SR3. This issue arises from an unexpected server crash in the database driver, which can be triggered by a highly privileged attacker through configuration changes. The vulnerability requires a vault admin level user to add or modify External Object Types.

Impact

Exploitation of this vulnerability leads to an unexpected server crash, causing a denial-of-service condition.