CVE-2021-41809

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server.

Low3.5EPSS 0.56%

Published: 18 Jan 2022
Updated: 23 Feb 2026
Reserved: 29 Sept 2021
Assigned by: M-Files Corporation

Description

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities.

Scores

CVSS scores of CVE-2021-41809, by who scored it
Scored by	CVSS	Score	Vector
M-Files CorporationCNA (assigner)	3.1	Low3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
NVDNVD · Modified	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS (exploitation in 30 days): 0.56% · top 53% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.

Weakness

CWE-918 Server-Side Request Forgery (SSRF) (opens in a new tab)All about CWE-918 and its CVEs

Affected products

M-Files · M-Files Server
- affected Online – < 22.1.11017.1

References (2)

https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41809/ (opens in a new tab)x_refsource_MISCx_transferred
https://empower.m-files.com/security-advisories/CVE-2021-41809 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-41809](https://trackcve.app/badge/CVE-2021-41809.svg)](https://trackcve.app/cve/CVE-2021-41809)

Record last updated 23 Feb 2026, 07:50 UTC.