CVE-2025-2091 in Mobile
Summary
by MITRE • 06/16/2025
An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2025
The vulnerability identified as CVE-2025-2091 represents a critical open redirection flaw within M-Files mobile applications designed for both Android and iOS platforms. This security weakness affects versions prior to 25.6.0 and stems from insufficient validation of URL parameters within the application's handling of PDF files. The flaw enables attackers to craft malicious PDF documents that contain deceptive links, which when opened by unsuspecting users, can redirect them to malicious websites or trigger unintended actions. Such open redirection vulnerabilities are particularly dangerous in mobile environments where users may be less cautious about clicking links within documents they trust.
The technical implementation of this vulnerability resides in the application's failure to properly sanitize and validate URL parameters embedded within PDF files. When users open PDF documents through the M-Files mobile app, the application processes embedded hyperlinks without adequate verification of their destination addresses. This creates an attack surface where malicious actors can embed crafted URLs that appear legitimate but redirect to phishing sites, malware distribution platforms, or other harmful destinations. The vulnerability specifically impacts the mobile application's document handling capabilities, where PDF files are processed and displayed, making it a prime target for social engineering attacks.
From an operational perspective, this vulnerability poses significant risks to enterprise security environments where M-Files mobile applications are widely deployed. Organizations using these applications for document management and collaboration are exposed to potential data breaches, credential theft, and malware infections when users inadvertently click on malicious links within PDF documents. The attack vector is particularly insidious because it leverages the trust users place in legitimate document files, making it difficult to distinguish between benign and malicious content. Security incidents resulting from this vulnerability could lead to unauthorized access to sensitive corporate data, disruption of business operations, and potential compliance violations.
Organizations should immediately implement mitigations including updating to M-Files mobile application version 25.6.0 or later, which contains the necessary patches to address this vulnerability. Network-level protections such as web application firewalls and URL filtering systems can provide additional defense-in-depth measures to block known malicious domains. Security awareness training for end users should emphasize the importance of verifying URLs before clicking links in PDF documents, even when they appear to come from trusted sources. The vulnerability aligns with CWE-601 Open Redirect weakness category and maps to ATT&CK technique T1566.001 Phishing, as it enables attackers to create convincing phishing campaigns through legitimate document formats. Additionally, this vulnerability demonstrates the importance of input validation and proper URL handling in mobile applications, as outlined in security best practices for mobile application development and the OWASP Mobile Top 10 framework.