CVE-2023-5524

Published: Oct 20, 2023Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.3 / Impact: 5.9

Source: NVD

Description

Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types

Affected (3)

Products: M Files: Web Companion

M Files

1 product

Web Companion

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
M Files Web Companion	From 23.3 to 23.10
M Files Web Companion	Before 23.8
M Files Web Companion	Version 23.8

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (3)

https://empower.m-files.com/security-advisories/CVE-2023-5524

Source: security@m-files.com

https://product.m-files.com/security-advisories/cve-2023-5524/

Source: security@m-files.com

https://www.m-files.com/about/trust-center/security-advisories/cve-2023-5524/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.