---
id: CVE-2025-11681
title: >-
  Denial-of-service condition in M-Files Server versions before 25.11.15392.1,
  before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to
  cause the MFserver process to crash.
summary: >-
  Denial-of-service condition in M-Files Server versions before 25.11.15392.1,
  before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to
  cause the MFserver process to crash.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: m-files
product: m-files_server
affected:
  - m-files_server < 25.2.14524.13
  - m-files_server < 25.11.15392.1
  - 'm-files_server >= 25.8.15085.13, < 25.8.15085.17'
patched:
  - m-files_server 25.8.15085.17
published: '2025-11-17'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T23:10:00.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11681'
references:
  - url: 'https://empower.m-files.com/security-advisories/CVE-2025-11681'
    label: security@m-files.com
  - url: 'https://product.m-files.com/security-advisories/cve-2025-11681/'
    label: security@m-files.com
tags:
  - nvd
epss: 0.00385
epssPercentile: 0.30052
ingestedAt: '2026-09-30T23:29:32.470Z'
---

## Overview

Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash.

## Affected

- `m-files_server < 25.2.14524.13`
- `m-files_server < 25.11.15392.1`
- `m-files_server >= 25.8.15085.13, < 25.8.15085.17`

## Remediation

Upgrade past the affected range:

- `m-files_server 25.8.15085.17`