CVE-2025-46320: Claris FileMaker Server XSS Vulnerability

CVE-2025-46320 Overview

CVE-2025-46320 is a cross-site scripting (XSS) vulnerability affecting the FileMaker WebDirect custom homepage feature in Claris FileMaker Server. An attacker who lures an authenticated user into clicking a crafted link can inject script into the WebDirect session, potentially leading to unauthorized access and remote code execution. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). Claris addressed the issue in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.

Critical Impact

Successful exploitation enables script execution in the WebDirect user's browser context, which Claris states could lead to unauthorized access and remote code execution.

Affected Products

• Claris FileMaker Server versions prior to 22.0.4
• Claris FileMaker Server versions prior to 21.1.7
• FileMaker WebDirect custom homepage component

Discovery Timeline

• 2026-02-24 - CVE-2025-46320 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-46320

Vulnerability Analysis

The vulnerability resides in the FileMaker WebDirect custom homepage, a feature that lets administrators present a branded landing page to web users before they access hosted FileMaker solutions. WebDirect renders user-controllable input into the custom homepage without sufficient output encoding. An attacker can craft a URL or payload that causes the server to reflect or store malicious script content. When a victim loads the page, the browser executes the attacker's script in the WebDirect origin.

Claris notes that exploitation can chain beyond simple session abuse into remote code execution. Script running in the WebDirect context can invoke server-side scripting or file operations available to the authenticated user, which expands impact past a typical browser-bound XSS payload.

Root Cause

The root cause is improper neutralization of input rendered into the WebDirect custom homepage. Input destined for an HTML context is not consistently HTML-encoded, and attacker-controlled data reaches the DOM as executable script. This is a classic [CWE-79] pattern where the trust boundary between user input and rendered markup is not enforced.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted link, typically through phishing or a malicious referrer, to a user who has access to the FileMaker WebDirect deployment. When the victim opens the link, the injected script runs within the WebDirect application. Because the scope is changed, the script can reach resources beyond the initial vulnerable component. No prior authentication or privileges are required on the attacker side. Technical exploit details are not publicly available; refer to the Claris Support FAQ for vendor guidance.

Detection Methods for CVE-2025-46320

Indicators of Compromise

• WebDirect access logs containing HTML or JavaScript syntax such as <script>, onerror=, or javascript: in query strings or referrer headers targeting the custom homepage path.
• Outbound HTTP requests from FileMaker Server hosts to unfamiliar domains following a WebDirect session.
• Unexpected FileMaker scripts executing through WebDirect sessions tied to phishing-related referrers.

Detection Strategies

• Inspect HTTP request and response bodies for the WebDirect custom homepage endpoint and alert on script-like payloads in user-supplied parameters.
• Correlate WebDirect authentication events with anomalous browser-driven actions, such as bulk record exports or administrative script calls shortly after login.
• Use web application firewall rules tuned for reflected and stored XSS patterns targeting the WebDirect URI namespace.

Monitoring Recommendations

• Forward FileMaker Server and reverse proxy logs to a centralized analytics platform such as Singularity Data Lake for OCSF-normalized search and retention.
• Monitor FileMaker Server hosts with endpoint telemetry to identify post-exploitation behaviors including unexpected child processes or script engine usage.
• Track WebDirect user-agent strings and source IP geolocation for deviations from baseline access patterns.

How to Mitigate CVE-2025-46320

Immediate Actions Required

• Upgrade Claris FileMaker Server to version 22.0.4 or 21.1.7 as appropriate for your release train.
• Audit existing WebDirect custom homepage content for any unexpected modifications or injected markup.
• Rotate FileMaker user credentials and session tokens if exploitation is suspected.
• Educate WebDirect users about phishing links that target FileMaker URLs.

Patch Information

Claris fixed CVE-2025-46320 in FileMaker Server 22.0.4 and FileMaker Server 21.1.7. Download links and release notes are available through the Claris Support FAQ. Apply the update on all FileMaker Server nodes, including secondary machines in multi-server deployments.

Workarounds

• Disable the FileMaker WebDirect custom homepage feature until the patch is applied if business workflows allow.
• Place FileMaker Server behind a web application firewall configured to strip or block script tags in request parameters targeting WebDirect URIs.
• Enforce a strict Content-Security-Policy at the reverse proxy to limit inline script execution against the WebDirect origin.

# Configuration example: verify installed FileMaker Server version
fmsadmin -v
# Expected output should be 22.0.4 or 21.1.7 (or later) after patching