CVE-2026-18371 in Web
Summary
by MITRE • 08/19/2026
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The identified security flaw resides within the M-Files Web application, specifically affecting versions prior to build number 26.8.16330.2. This vulnerability is classified as a Cross-Site Scripting issue, more precisely categorized under CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as HTML injection or stored cross-site scripting when the payload persists on the server side. The core technical deficiency lies in the application's failure to adequately sanitize user-supplied input before rendering it within the web interface for other users. When an authenticated attacker submits malicious content containing executable script tags, event handlers, or other active elements through a vulnerable field, the backend processes this data without applying sufficient output encoding or validation rules. Consequently, when another legitimate user accesses the affected page, their browser interprets and executes the injected code as part of the trusted domain context. This mechanism allows the attacker to bypass same-origin policy restrictions because the malicious script runs with the privileges associated with the application itself rather than an external origin.
The operational impact of this vulnerability is significant due to the requirement for authentication. While it does not allow immediate access by unauthenticated outsiders, it enables a compromised or malicious insider account to launch targeted attacks against other users within the organization. An attacker can exploit this flaw to steal session cookies, capture sensitive keystrokes, perform actions on behalf of victims such as modifying documents or changing settings without authorization, and redirect users to phishing sites that mimic legitimate M-Files interfaces. This undermines the integrity and confidentiality of the document management system by allowing unauthorized manipulation of user interactions and potentially leading to broader credential theft if combined with other social engineering tactics. The persistence of this data means that every subsequent view of the compromised content triggers the attack, amplifying the blast radius across multiple sessions until the malicious entry is manually removed or patched.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically JavaScript execution within web browsers. It also relates to T1078 Valid Accounts where attackers leverage existing credentials to maintain access and execute malicious payloads against other users. The lack of proper input validation represents a fundamental design flaw in the application's security architecture, highlighting the necessity for robust content security policies and strict output encoding mechanisms. To mitigate this risk, organizations must immediately upgrade M-Files Web to version 26.8.16330.2 or later where these sanitization routines have been corrected. In addition to patching, administrators should implement a Content Security Policy header that restricts the execution of inline scripts and ensures that only trusted sources can deliver executable content. Regular security audits focusing on input validation across all user-facing forms are essential to prevent similar injection flaws in other modules of the application ecosystem.