CVE-2026-18372

A CSS injection vulnerability exists in M-Files Web versions prior to 26.8.16330.2, allowing authenticated vault administrators to inject arbitrary CSS code that can manipulate the web user interface for other vault users. This could lead to unauthorized content display or phishing attempts, posing a risk to user trust and data integrity. Organizations using M-Files Web should prioritize patching this vulnerability to safeguard their web interfaces and user interactions.