Claris Filemaker Server vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Claris Filemaker Server: 5 record(s), with affected versions and fixes.cpe:2.3:a:claris:filemaker_server
CVE-2026-43752
Medium · 4.9
CWE-434 Jul 9, 2026
Unrestricted Upload of File with Dangerous Type in Claris Filemaker Server
An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the Admin Console. This vulnerability has been addressed in FileMaker Server 26.0.1.
CVE-2025-46320
Medium · 6.1
CWE-79 Feb 24, 2026
Cross-site Scripting (XSS) in Claris Filemaker Server
A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.
CVE-2025-46296
Medium · 5.4
CWE-285 Dec 16, 2025
Improper Authorization in Claris Filemaker Server
An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing license details and downloading application logs. This vulnerability has been fully addressed in FileMaker Server 22.0.4.
CVE-2025-46295
Critical · 9.8
CWE-94 Dec 16, 2025
Code Injection in Claris Filemaker Server
Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could potentially achieve remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4.
CVE-2025-46294
Medium · 5.3
CWE-200 Dec 16, 2025
Exposure of Sensitive Information in Claris Filemaker Server
To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCreation in the Windows registry. This prevents attackers from using the tilde character to discover hidden files and directories. This vulnerability has been fully addressed in FileMaker Server 22.0.4. The IIS Shortname Vulnerability exploits how Microsoft IIS handles legacy 8.3 short filenames, allowing attackers to infer the existence of files or directories by crafting requests with the tilde (~) character.