CVE-2025-46320 in FileMaker Server
Summary
by MITRE • 02/24/2026
A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/24/2026
This cross-site scripting vulnerability exists within FileMaker WebDirect custom homepage functionality, representing a critical security flaw that can be exploited to compromise the entire system. The vulnerability allows attackers to inject malicious scripts into web pages viewed by users, potentially enabling unauthorized access to sensitive data and system resources. The issue specifically affects the custom homepage rendering mechanism within FileMaker WebDirect, which is designed to provide web-based access to FileMaker databases through a browser interface. This vulnerability falls under the CWE-79 category for cross-site scripting, which is classified as a fundamental web application security weakness that enables attackers to execute scripts in the context of other users.
The technical exploitation of this vulnerability occurs when FileMaker WebDirect fails to properly sanitize user input within custom homepage configurations. Attackers can craft malicious payloads that get executed when the homepage is rendered in a user's browser, potentially leading to session hijacking, data theft, or even complete system compromise. The flaw demonstrates a classic input validation failure where user-supplied data is directly incorporated into web page content without adequate sanitization or encoding mechanisms. This type of vulnerability aligns with ATT&CK technique T1566.001 for spearphishing attachments and T1071.001 for application layer protocol usage, as it exploits web application interfaces to deliver malicious payloads.
The operational impact of this vulnerability extends beyond simple script execution, as successful exploitation could enable attackers to perform remote code execution on the FileMaker Server. This capability allows adversaries to gain persistent access to the system, potentially leading to data breaches, system infiltration, and further lateral movement within the network. Organizations using FileMaker Server with WebDirect functionality are particularly at risk, as the vulnerability affects the core web delivery mechanisms that many businesses rely upon for database access and management. The vulnerability's severity is compounded by the fact that it can be exploited without requiring authentication, making it especially dangerous in environments where FileMaker Server is exposed to untrusted networks.
Organizations should immediately apply the patches released in FileMaker Server 22.0.4 and FileMaker Server 21.1.7 to address this vulnerability. System administrators should conduct thorough security assessments of their FileMaker WebDirect configurations to identify any custom homepages that may be vulnerable to injection attacks. Additional mitigations include implementing proper input validation controls, using content security policies, and restricting access to FileMaker WebDirect interfaces through network segmentation. The vulnerability demonstrates the critical importance of maintaining up-to-date security patches and implementing defense-in-depth strategies to protect against web application attacks. Regular security monitoring and vulnerability scanning should be implemented to detect potential exploitation attempts and ensure continued system integrity.