CVE-2025-0635: 
M-Files Server vulnerability analysis and mitigation

A denial of service vulnerability was identified in M-Files Server versions prior to 25.1.14445.5. The vulnerability, tracked as CVE-2025-0635, was discovered and disclosed on January 23, 2025, affecting M-Files Server installations (M-Files Advisory).

The vulnerability allows an unauthenticated user to consume computing resources under certain conditions. The issue is categorized under CWE-770: Allocation of Resources Without Limits or Throttling and CAPEC-229: Serialized Data Parameter Blowup. The vulnerability has been assigned a CVSS 4.0 base score of 6.3 with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (M-Files Advisory).

When exploited, the vulnerability causes slow processing in the M-Files Server system. While the denial of service condition affects system performance, it does not completely prevent the system from functioning (M-Files Advisory).

The vulnerability was internally discovered and has not been publicly disclosed or exploited in the wild. The probability of exploitation is considered low according to the vendor's assessment (M-Files Advisory).

Users are advised to upgrade to M-Files Server version 25.1.14445.5 or later to address this vulnerability (M-Files Advisory).