CVE-2025-9826: Stored XSS in M-Files Hubshare

DESCRIPTION

Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users.

AFFECTED PRODUCTS

M-Files Hubshare before Aug ’25 (25.8)

MORE INFORMATION

Mitigation for this vulnerability is to update M-Files Hubshare to August ’25 release (25.8) or newer.
Hubshare cloud customers will be updated automatically.

CVSS 4.0 Base Score (CVSS-B): 7.0
CVSS 4.0 Base+Threat (CVSS-BT): 4.7

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

CWE: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

CAPEC: CAPEC-592: Stored XSS

Internal ID: HUB-905

Date issued: 2025-09-15

Alternate IDs: EUVD-2025-29173

EXPLOITABILITY

Publicly disclosed: No
Exploited: No
Probability of exploitation: low – responsibly reported

LINKS

https://www.cve.org/CVERecord?id=CVE-2025-9826

HISTORY

2025-09-15 Published