CVE-2025-46294
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-16

Last updated on: 2025-12-23

Assigner: Apple Inc.

Description
To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCreation in the Windows registry. This prevents attackers from using the tilde character to discover hidden files and directories. This vulnerability has been fully addressed in FileMaker Server 22.0.4. The IIS Shortname Vulnerability exploits how Microsoft IIS handles legacy 8.3 short filenames, allowing attackers to infer the existence of files or directories by crafting requests with the tilde (~) character.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-12-16
Last Modified
2025-12-23
Generated
2026-07-06
AI Q&A
2025-12-16
EPSS Evaluated
2026-07-05
NVD
CVE-2025-46294
EUVD
EUVD-2025-203828

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
claris filemaker_server to 22.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Microsoft IIS handling of legacy 8.3 short filenames, where attackers can use the tilde (~) character to enumerate and discover hidden files and directories on the server. The FileMaker Server 22.0.4 installer includes an option to disable this behavior by setting NtfsDisable8dot3NameCreation in the Windows registry, preventing such enumeration attacks.

Impact Analysis

An attacker exploiting this vulnerability can infer the existence of hidden files or directories on a server by using crafted requests with the tilde (~) character. This could lead to unauthorized information disclosure or aid in further attacks by revealing sensitive file locations.

Mitigation Strategies

To mitigate this vulnerability, update FileMaker Server to version 22.0.4 or later, which includes an option to disable IIS short filename enumeration by setting the NtfsDisable8dot3NameCreation registry key in Windows. This prevents attackers from using the tilde (~) character to discover hidden files and directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-46294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart