Claris vulnerabilities
We track 8 vulnerabilities in Claris products across 3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest Claris vulnerabilities
- 7.3 High severity
FileMaker Pro: Authorization Bypass Through User-Controlled Key
A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMa
- 9.1 Critical severity
FileMaker Server: Authorization Bypass Through User-Controlled Key
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnera
- 9.1 Critical severity
FileMaker Server: Out-of-bounds Read
An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed i
- 7.8 High severity
FileMaker Server: Heap-based Buffer Overflow
A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed i
- 7.2 High severity
FileMaker Cloud: Improper Neutralization of Special Elements used in an OS Command
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed i
- 7.2 High severity
FileMaker Cloud: Improper Control of Generation of Code
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a front-end restriction on OS Script schedule types and execute arbitrary operating system commands on the underlying host. This issue is fix
- 9.8 Critical severity
FileMaker Server: Improper Control of Generation of Code
Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing ext
- 7.5 High severity
FileMaker Server: Improper Access Control
Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue has been fixed in FileMaker Server 20.3.2 by validating transactions before replying to client requests