CVE-2025-46294: Claris FileMaker Server Info Disclosure

CVE-2025-46294 Overview

CVE-2025-46294 affects Claris FileMaker Server installations on Windows that use Microsoft Internet Information Services (IIS). The vulnerability allows unauthenticated remote attackers to enumerate files and directories by abusing legacy 8.3 short filename handling in IIS. Attackers craft HTTP requests containing the tilde (~) character to infer the existence of hidden files and directories on the server. Claris addressed the issue in FileMaker Server 22.0.4, whose installer now offers an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCreation in the Windows registry. The weakness is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated network attackers can enumerate file and directory names on FileMaker Server hosts, exposing information useful for follow-on attacks.

Affected Products

Claris FileMaker Server versions prior to 22.0.4 on Windows with IIS
Windows hosts with NTFS 8.3 short filename creation enabled
IIS-backed FileMaker Server web publishing components

Discovery Timeline

2025-12-16 - CVE-2025-46294 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46294

Vulnerability Analysis

The vulnerability is an information disclosure flaw rooted in how Microsoft IIS resolves legacy 8.3 short filenames on NTFS volumes. FileMaker Server on Windows relies on IIS to serve web-facing components. When 8.3 name creation is enabled, every long file and directory name receives a corresponding short alias such as LONGFI~1. IIS resolves URLs containing tilde-suffixed fragments against these aliases and returns distinguishable responses based on whether a match exists.

Attackers script HTTP requests that iterate through candidate short-name prefixes followed by the tilde character. Response codes and error differences reveal whether files or directories starting with a given prefix are present. Repeated queries reconstruct partial filenames, exposing backup files, configuration artifacts, and administrative endpoints that were intended to remain hidden. No authentication or user interaction is required.

Root Cause

The root cause is the default Windows behavior of generating 8.3 short filenames combined with IIS URL parsing that treats tilde fragments as valid short-name lookups. FileMaker Server installers prior to 22.0.4 did not disable this behavior, leaving the underlying filesystem metadata exposed through the web tier.

Attack Vector

Exploitation occurs over the network against the FileMaker Server HTTP or HTTPS endpoint. An attacker sends a series of requests such as GET /a*~1*/.aspx and observes differential responses. No credentials, prior access, or user interaction are required. The technique is well documented in public IIS tooling and can be automated against exposed servers.

See the Claris Support Article for vendor technical details.

Detection Methods for CVE-2025-46294

Indicators of Compromise

HTTP request logs containing the tilde (~) character in URL paths, particularly patterns like /*~1* or /name~1/
Bursts of requests from a single source producing high volumes of 404 and 400 responses against IIS
User-Agent strings matching known short-name scanners such as IIS ShortName Scanner

Detection Strategies

Parse IIS access logs for tilde-containing URIs and alert on anomalous frequencies per source IP
Deploy web application firewall rules that flag or block requests where the URL path contains ~ followed by a digit
Correlate scan activity with subsequent access attempts to previously undisclosed paths to identify successful enumeration

Monitoring Recommendations

Baseline normal FileMaker Server URL patterns and alert on deviations involving short-name syntax
Forward IIS logs to a centralized analytics platform for retention and cross-host correlation
Verify the NtfsDisable8dot3NameCreation registry value on all FileMaker Server hosts as part of routine configuration audits

How to Mitigate CVE-2025-46294

Immediate Actions Required

Upgrade Claris FileMaker Server to version 22.0.4 using the updated installer that disables 8.3 name creation
Set the registry value HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation to 1 on affected hosts
Strip existing 8.3 aliases from FileMaker Server data volumes using fsutil 8dot3name strip
Restrict inbound access to FileMaker Server web endpoints to trusted networks where feasible

Patch Information

Claris resolved CVE-2025-46294 in FileMaker Server 22.0.4. The updated installer configures NtfsDisable8dot3NameCreation during setup. Refer to the Claris Support Article for release notes and upgrade guidance.

Workarounds

Disable 8.3 filename creation at the filesystem level and remove existing short names before restarting IIS
Configure IIS URL Rewrite or request filtering rules to reject URIs containing the tilde character
Place FileMaker Server behind a reverse proxy or WAF that normalizes and inspects request paths

bash

# Configuration example
# Disable 8.3 short filename creation system-wide
fsutil behavior set disable8dot3 1

# Strip existing 8.3 names from the FileMaker data volume
fsutil 8dot3name strip /s /v C:\Program Files\FileMaker\FileMaker Server

# Verify current setting
reg query "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v NtfsDisable8dot3NameCreation