CVE-2025-46294 Information disclosure in FileMaker Server

Medium 5.3 Published 16 Dec 2025 Updated 16 Dec 2025

Attackers can enumerate hidden files and directories via IIS shortname enumeration, exposing sensitive information in FileMaker Server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-46294?

CVE-2025-46294 is a medium-severity vulnerability in Claris FileMaker Server, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCreation in the Windows registry. This prevents attackers from using the tilde character to discover hidden files and directories. This vulnerability has been fully addressed in FileMaker Server 22.0.4. The IIS Shortname Vulnerability exploits how Microsoft IIS handles legacy 8.3 short filenames, allowing attackers to infer the existence of files or directories by crafting requests with the tilde (~) character.

Weakness: CWE-200

Which versions are affected by CVE-2025-46294?

It affects 1 product.

Products include Claris Filemaker Server.

How do I fix CVE-2025-46294?

No fix has been published for CVE-2025-46294 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-46294 being exploited?

There is no known exploitation of CVE-2025-46294 in the wild and no public exploit code.

Sources

Also known as GHSA-2jrm-5c9c-9px7.