CVE-2025-2091

An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://product.m-files.com/security-advisories/cve-2025-2091	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:m-files:m-files_mobile::::::android::*
	cpe:2.3:a:m-files:m-files_mobile::::::iphone_os::*

History

29 Oct 2025, 18:58

Type	Values Removed	Values Added
CPE		cpe:2.3:a:m-files:m-files_mobile::::::android::* cpe:2.3:a:m-files:m-files_mobile::::::iphone_os::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4
First Time		M-files M-files m-files Mobile
References	~~() https://product.m-files.com/security-advisories/cve-2025-2091 -~~	() https://product.m-files.com/security-advisories/cve-2025-2091 - Vendor Advisory

16 Jun 2025, 12:32

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-16 09:15

Updated : 2025-10-29 18:58

NVD link : CVE-2025-2091

Mitre link : CVE-2025-2091

CVE.ORG link : CVE-2025-2091

JSON object : View

Products Affected

m-files

m-files_mobile

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-2091", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security@m-files.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-16T09:15:19.067", "references": [{"url": "https://product.m-files.com/security-advisories/cve-2025-2091", "tags": ["Vendor Advisory"], "source": "security@m-files.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@m-files.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs."}, {"lang": "es", "value": "Una vulnerabilidad de redirecci\u00f3n abierta en las aplicaciones m\u00f3viles M-Files para Android e iOS anteriores a la versi\u00f3n 25.6.0 permite a los atacantes utilizar archivos PDF manipulados con fines maliciosos para enga\u00f1ar a otros usuarios para que realicen solicitudes a URL no confiables."}], "lastModified": "2025-10-29T18:58:21.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:m-files:m-files_mobile:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "785C53CF-F067-46DB-A859-BA0D209F030D", "versionEndExcluding": "25.6.0"}, {"criteria": "cpe:2.3:a:m-files:m-files_mobile:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "CE792A25-990F-4BB8-9638-3105C5223A9C", "versionEndExcluding": "25.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@m-files.com"}