Medium severity · published Aug 19, 2026
CVE-2026-18372
CSS injection in M-Files Web
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
M-Files Web · M-Files Corporation
before 26.8.16330.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18372
empower.m-files.com
https://empower.m-files.com/security-advisories/CVE-2026-18372
More from M-Files Web
5.1
CVE-2026-18371
HTML injection in M-Files Web