CVE-2025-46320 Details
Description
A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.
A cross-site scripting (XSS) vulnerability has been identified in Claris FileMaker WebDirect custom homepages. This issue could lead to unauthorized access and remote code execution. The vulnerability affects FileMaker Server versions 21.1.6 and prior, as well as version 22.0.3 and prior.
Users are advised to update to FileMaker Server version 22.0.4 or 21.1.7.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.claris.com/s/answerview?anum=000049123&language=en_US | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| claris filemaker server | < 21.1.7 >= 22.0.1, < 22.0.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | CVE Modified | CISA-ADP |
| Feb 24, 2026 | New CVE Received | [email protected] |