CVE-2025-2091
Last modified
CVE-2025-2091 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Green
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| M-Files | M-Files Mobile | < 25.6.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-2091?
How severe is CVE-2025-2091?
How do I fix CVE-2025-2091?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-20904Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-20…6.7
- CVE-2025-20905Out-of-bounds read and write in mPOS TUI trustlet prior to S…6.7
- CVE-2025-20906Improper Export of Android Application Components in Setting…5.5
- CVE-2025-20907Improper privilege management in Samsung Find prior to SMR F…4.4
- CVE-2025-20908Use of insufficiently random values in Auracast prior to SMR…6.5
- CVE-2025-20909Use of implicit intent for sensitive communication in Settin…5.5
- CVE-2025-20910Incorrect default permission in Galaxy Watch Gallery prior t…6.2
- CVE-2025-20911Improper access control in sem_wifi service prior to SMR Mar…4.4
- CVE-2025-20912Incorrect default permission in DiagMonAgent prior to SMR Ma…6.2
- CVE-2025-20913Out-of-bounds read in applying binary of drawing content in …5.5
- CVE-2025-20914Out-of-bounds read in applying binary of hand writing conten…7.5
- CVE-2025-20915Out-of-bounds read in applying binary of voice content in Sa…7.5
Are you affected by CVE-2025-2091?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST