PT-2026-21797 · Clarisa · Filemaker Server+1

Published 2026-02-24 · Updated 2026-02-25 · CVE-2025-46320

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FileMaker versions prior to 22.0.4 FileMaker versions prior to 21.1.7

Description A cross-site scripting (XSS) issue exists in FileMaker WebDirect custom homepages. Successful exploitation of this issue could allow for unauthorized access and remote code execution.

Recommendations Update to FileMaker Server 22.0.4 or later. Update to FileMaker Server 21.1.7 or later.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-46320

Affected Products

Filemaker

Filemaker Server

References · 6

• https://support.claris.com/s/answerview?anum=000049123&language=en_US · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46320 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46320 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2026473826939252869 · Twitter Post
• https://t.me/CVEtracker/45656 · Telegram Post
• https://twitter.com/CVEnew/status/2026676424669802574 · Twitter Post