Product:
FileMaker WebDirect
Summary
A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-46320 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious link that targets the FileMaker WebDirect custom homepage. When a user interacts with this link, the attacker can execute arbitrary code in the context of the user’s session, potentially leading to unauthorized access to sensitive information or system control.
Affected Products
- FileMaker Server 22.0.4 – Addressed the XSS vulnerability.
- FileMaker Server 21.1.7 – Addressed the XSS vulnerability.
Mitigation
To mitigate this vulnerability, users should update to the latest versions of FileMaker Server, specifically 22.0.4 or 21.1.7, which contain the necessary security fixes. Additionally, users should implement security best practices to minimize exposure to XSS attacks.