CVE-2025-5964

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-59657.2In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper NeutralizationCVE-2025-59668.1Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword repoCVE-2025-596688.7Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. When processing a crafted certain UDP packetCVE-2025-596695.5A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0CVE-2025-59675.3A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan NCVE-2025-596819.8An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySeCVE-2025-596826.5An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, uCVE-2025-596839.1Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with OfficeCVE-2025-596848.8DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.CVE-2025-596855.3Kazaar 1.25.12 allows a JWT with none in the alg field.CVE-2025-596866.5Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id.CVE-2025-596874.3IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and noti
CVE-2025-5964: Medium severity, CVSS 6.5 | Vulnix