Medium severity · published May 2, 2022
CVE-2021-41810
Script injection in M-Files Admin
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
M-Files Server · M-Files Corporation
M-Files Server before 22.2.11051.0 · source: vendor
SE
Server · M-files
before 22.2.11051.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41810
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41810
empower.m-files.com
https://empower.m-files.com/security-advisories/CVE-2021-41810
product.m-files.com
https://product.m-files.com/security-advisories/cve-2021-41810/
Vendor Advisory
https://www.m-files.com/about/trust-center/security-advisories/cve-2021-41810/
More from M-Files Server
9.8
CVE-2024-10127
Support for authentication bypass condition in M-Files LDAP authentication
9.8
CVE-2023-6912
Brute force vulnerability in M-Files user authentication
8.6
CVE-2025-13008
Session Token Disclosure in M-Files Web
7.5
CVE-2025-0635
Denial of Service condition in M-Files Server
7.5
CVE-2024-4056
Denial of service condition in M-Files Server