CVE-2026-86934 – Claris FileMaker Server
“One crafted image or one forged header is all it takes to turn your FileMaker Server against the data it was built to protect.”
Claris FileMaker Server 26.0.3 fixes two Critical vulnerabilities that expose server memory and bypass access controls. CVE-2026-86930 has a CVSS score of 9.1, Critical severity. It is an out-of-bounds read in FileMaker Server for Linux: an attacker who uploads a crafted image to a container field can disclose process memory while FileMaker WebDirect generates thumbnails. CVE-2026-86934 has a CVSS score of 9.1, Critical severity. It is an authorization bypass in the Web Publishing Engine: requests carrying an extended privilege header skip the disabled Custom Web Publishing with XML setting and reach the XML Web Publishing interface.
Together, these flaws let attackers read sensitive memory and reach interfaces that administrators deliberately turned off. Upgrade every FileMaker Server deployment to version 26.0.3.
Key Details
- Affected Product
- Claris Filemaker Server
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-639