CVE-2025-2091

4.8 mediumEPSS 0.3%

An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/RE:M/U:Green

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-601
Published: 2025-06-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

m-files:m-files_mobile

References

https://empower.m-files.com/security-advisories/CVE-2025-2091
https://product.m-files.com/security-advisories/cve-2025-2091

Check your stack JSON