CVE-2026-86930: FileMaker Filemaker Server vulnerability
An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileMaker Serverto a version that resolves this vulnerability.Fixed in 26.0.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FileMaker Server for Linux is affected when an attacker can upload a specially crafted image file to a container field and WebDirect generates a thumbnail for that file. The issue concerns process-memory disclosure during thumbnail generation.
What does an attacker need to exploit the vulnerability?
The attacker needs the ability to upload a specially crafted image file to a container field. Exploitation occurs when FileMaker WebDirect generates a thumbnail for the uploaded image.
What version addresses the issue?
The vulnerability is addressed in FileMaker Server version 26.0.3.