PT-2025-51763 · Microsoft+1 · Iis+1

Published 2025-12-16 · Updated 2025-12-23 · CVE-2025-46294

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FileMaker Server versions prior to 22.0.4

Description The FileMaker Server software is susceptible to an issue related to IIS short filename enumeration. Attackers can potentially discover hidden files and directories by leveraging the tilde character in requests to Microsoft IIS. This is due to how IIS handles legacy 8.3 short filenames. The FileMaker Server 22.0.4 installer includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCreation in the Windows registry to mitigate this.

Recommendations Update to FileMaker Server version 22.0.4. Set NtfsDisable8dot3NameCreation in the Windows registry.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-46294

Affected Products

Filemaker Server

Iis

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-46294 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46294 · Vendor Advisory
• https://support.claris.com/s/answerview?anum=000048450&language=en_US · Vendor Advisory
• https://t.me/cveNotify/146662 · Telegram Post
• https://twitter.com/CVEnew/status/2001350875584074026 · Twitter Post
• https://t.me/CVEtracker/39983 · Telegram Post