CVE-2025-0648: 
M-Files Server vulnerability analysis and mitigation

A vulnerability identified as CVE-2025-0648 was discovered in M-Files Server, affecting versions before 25.1.14445.5 and before 24.8 LTS SR3. The vulnerability was disclosed on January 23, 2025, and involves an unexpected server crash in the database driver component that could lead to a denial of service condition (M-Files Advisory).

The vulnerability is classified as CWE-248 (Uncaught Exception) and has received a CVSS 4.0 Base Score of 5.9 (Medium). The CVSS vector string is CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, indicating that the vulnerability requires network access and high privileges but no user interaction to exploit (M-Files Advisory).

The vulnerability allows a highly privileged attacker to cause a denial of service condition through configuration changes. The impact is limited to service availability, with no direct effect on confidentiality or integrity (NVD).

The vulnerability has been patched in M-Files Server version 25.1.14445.5 and version 24.8 LTS SR3 (24.8.13981.14). Users are advised to upgrade to these or later versions to mitigate the vulnerability (M-Files Advisory).