M-Files Server Data Leak Vulnerability via Improper Removal of Temporary Caching Data

A vulnerability in M-Files Server, affecting versions prior to 25.12.15491.7, allows for data leaks due to the incomplete removal of sensitive information before transfer. This issue arises when an administrator copies a vault using the 'metadata structure only' option, as some temporary activity data intended for caching is not properly cleared. Consequently, the copied vault may inadvertently include sensitive or personally identifiable information from the source vault, such as file names, user names, and comments. The vulnerability can also cause random activity feed data from another vault to appear on objects in the new vault.

Impact

Exploitation of this vulnerability could lead to unauthorized data exposure, including sensitive information and personally identifiable information, from the source vault to the target vault.

Remediation

Users are advised to upgrade to version 25.12.15491.7 or newer. The update will remove the cached data during the upgrade process.