Path traversal in M-Files API

The impact of this path traversal vulnerability is significant, as it allows an authenticated user to bypass access controls and read arbitrary files on the server. An attacker could potentially access configuration files, database credentials, or other sensitive data stored on the system. This could lead to data breaches, privilege escalation, and further compromise of the M-Files Server environment. The ability to read files outside the intended directory represents a serious security risk, particularly if the server stores confidential information.

Organizations utilizing M-Files Server with versions prior to LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 are at risk. This includes deployments where user authentication is enabled and file access permissions are not strictly enforced. Shared hosting environments utilizing M-Files Server are particularly vulnerable.

1. 2024-08-27Disclosure

   disclosure

1. आरक्षित2024-07-16
2. प्रकाशित2024-08-27
3. संशोधित2026-02-23
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-6789 is to upgrade M-Files Server to version LTS 24.2.13421.15 SR2 or later. Prior to upgrading, it is recommended to review the M-Files Server release notes for any potential compatibility issues or breaking changes. Consider implementing stricter access controls and file permissions to limit the potential impact of this vulnerability, even after patching. Regularly audit file system access logs to detect any suspicious activity.