soliantconsulting/cve-2025-46295-fix-fmsAutomated script suite to detect and remediate CVE-2025-46295 by replacing vulnerable Apache Commons JARs in FileMaker Server installations with dry-run, backup, and rollback support.
The FileMaker Apache Commons JAR Replacer is an automation solution that addresses CVE-2025-46295 by replacing vulnerable Apache Commons JAR files in FileMaker Server installations. Instead of upgrading the entire FileMaker Server, this solution follows the official Claris guidance to replace only the vulnerable commons-text and commons-lang3 JAR files with updated versions.
For most users, download the latest release instead of building from source:
Go to the Releases page
Download the appropriate file for your platform:
filemaker-jar-replacer-windows.zipfilemaker-jar-replacer-macos.tar.gzfilemaker-jar-replacer-ubuntu.tar.gzExtract and run - See the release notes for detailed extraction and usage instructions
The affected JAR files are installed only when the Web Publishing Engine is enabled for the first time.
This JAR replacer provides platform-specific scripts for:
replace-filemaker-jars-windows.ps1)replace-filemaker-jars-macos.sh)replace-filemaker-jars-ubuntu.sh)IMPORTANT: Before making any changes to your FileMaker Server, run the script with the --dry-run option to check if your server is vulnerable and see what changes would be made.
# Run PowerShell as Administrator
# Show help and available options
.\replace-filemaker-jars-windows.ps1 -Help
# Check if your server is vulnerable (RECOMMENDED FIRST STEP)
.\replace-filemaker-jars-windows.ps1 -DryRun
# Apply the security fix (only after reviewing dry-run results)
.\replace-filemaker-jars-windows.ps1
# Run with sudo privileges
# Show help and available options
sudo ./replace-filemaker-jars-macos.sh --help
# Check if your server is vulnerable (RECOMMENDED FIRST STEP)
sudo ./replace-filemaker-jars-macos.sh --dry-run
# Apply the security fix (only after reviewing dry-run results)
sudo ./replace-filemaker-jars-macos.sh
# Run with sudo privileges
# Show help and available options
sudo ./replace-filemaker-jars-ubuntu.sh --help
# Check if your server is vulnerable (RECOMMENDED FIRST STEP)
sudo ./replace-filemaker-jars-ubuntu.sh --dry-run
# Apply the security fix (only after reviewing dry-run results)
sudo ./replace-filemaker-jars-ubuntu.sh
The --dry-run option is the safest way to:
Always run with --dry-run first to understand what the script will do on your system.
filemaker-jar-replacer/
├── README.md # This file
├── replace-filemaker-jars-windows.ps1 # Windows PowerShell script
├── replace-filemaker-jars-macos.sh # macOS Bash script
├── replace-filemaker-jars-ubuntu.sh # Ubuntu Bash script
├── scripts/
│ ├── windows/
│ │ └── modules/ # PowerShell modules for JAR operations
│ ├── macos/
│ │ └── modules/ # Bash function modules for JAR operations
│ ├── ubuntu/
│ │ └── modules/ # Bash function modules for JAR operations
│ └── shared/ # Shared utilities and templates
├── config/
│ ├── logging-config.json # Logging configuration
│ └── jar-replacement-config.json # JAR replacement configuration
├── tests/ # Test suite (BATS and Pester)
├── logs/ # Log files (created during execution)
└── backups/ # JAR backup files (created during execution)
You can configure the updater using environment variables:
# FileMaker Server credentials
export FILEMAKER_USERNAME="admin"
export FILEMAKER_PASSWORD="your_secure_password"
# Custom paths (optional)
export FILEMAKER_INSTALL_PATH="/custom/path/to/filemaker"
export BACKUP_DIRECTORY="/custom/backup/path"
Create a .env file in the script directory:
# .env file (must have 600 permissions)
FILEMAKER_USERNAME=admin
FILEMAKER_PASSWORD=your_secure_password
BACKUP_DIRECTORY=/custom/backup/path
Important: Ensure .env file has restrictive permissions (600) for security.
If the automated script fails, follow these manual steps to replace the vulnerable JAR files:
# Using fmsadmin (recommended)
& "C:\Program Files\FileMaker\FileMaker Server\Database Server\fmsadmin.exe" stop wpe -u admin -p password
# Or using services
Stop-Service "FileMaker Server Web Publishing Engine"
# Using fmsadmin (recommended)
sudo "/Library/FileMaker Server/Database Server/bin/fmsadmin" stop wpe -u admin -p password
# Or using launchctl
sudo launchctl stop com.filemaker.wpe
# Using fmsadmin (recommended)
sudo "/opt/FileMaker/FileMaker Server/Database Server/bin/fmsadmin" stop wpe -u admin -p password
# Or using systemctl
sudo systemctl stop filemaker-wpe
$jarPath = "C:\Program Files\FileMaker\FileMaker Server\Web Publishing\publishing-engine\jwpc-tomcat\webapps\ROOT\WEB-INF\lib"
$backupPath = "C:\Temp\jar-backup-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
New-Item -ItemType Directory -Path $backupPath
Copy-Item "$jarPath\commons-text-*.jar" $backupPath
Copy-Item "$jarPath\commons-lang3-*.jar" $backupPath
JAR_PATH="/Library/FileMaker Server/Web Publishing/publishing-engine/jwpc-tomcat/webapps/ROOT/WEB-INF/lib" # macOS
# JAR_PATH="/opt/FileMaker/FileMaker Server/Web Publishing/publishing-engine/jwpc-tomcat/webapps/ROOT/WEB-INF/lib" # Ubuntu
BACKUP_PATH="/tmp/jar-backup-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_PATH"
cp "$JAR_PATH"/commons-text-*.jar "$BACKUP_PATH/"
cp "$JAR_PATH"/commons-lang3-*.jar "$BACKUP_PATH/"
Download the following JAR files from Apache Commons:
Verify checksums against official Apache Commons checksums.
$jarPath = "C:\Program Files\FileMaker\FileMaker Server\Web Publishing\publishing-engine\jwpc-tomcat\webapps\ROOT\WEB-INF\lib"
# Remove old JAR files
Remove-Item "$jarPath\commons-text-*.jar"
Remove-Item "$jarPath\commons-lang3-*.jar"
# Copy new JAR files
Copy-Item "commons-text-1.11.0.jar" $jarPath
Copy-Item "commons-lang3-3.18.0.jar" $jarPath
JAR_PATH="/Library/FileMaker Server/Web Publishing/publishing-engine/jwpc-tomcat/webapps/ROOT/WEB-INF/lib" # macOS
# JAR_PATH="/opt/FileMaker/FileMaker Server/Web Publishing/publishing-engine/jwpc-tomcat/webapps/ROOT/WEB-INF/lib" # Ubuntu
# Remove old JAR files
sudo rm "$JAR_PATH"/commons-text-*.jar
sudo rm "$JAR_PATH"/commons-lang3-*.jar
# Copy new JAR files
sudo cp commons-text-1.11.0.jar "$JAR_PATH/"
sudo cp commons-lang3-3.18.0.jar "$JAR_PATH/"
# Set proper permissions
sudo chown fmserver:fmsadmin "$JAR_PATH"/commons-*.jar # Adjust ownership as needed
sudo chmod 644 "$JAR_PATH"/commons-*.jar
# Using fmsadmin (recommended)
& "C:\Program Files\FileMaker\FileMaker Server\Database Server\fmsadmin.exe" start wpe -u admin -p password
# Or using services
Start-Service "FileMaker Server Web Publishing Engine"
# Using fmsadmin (recommended)
sudo "/Library/FileMaker Server/Database Server/bin/fmsadmin" start wpe -u admin -p password
# Or using launchctl
sudo launchctl start com.filemaker.wpe
# Using fmsadmin (recommended)
sudo "/opt/FileMaker/FileMaker Server/Database Server/bin/fmsadmin" start wpe -u admin -p password
# Or using systemctl
sudo systemctl start filemaker-wpe
If the automated script fails, follow these manual steps:
net stop "FileMaker Server"
sudo launchctl stop com.filemaker.fms
sudo service fmshelper stop
net start "FileMaker Server"
sudo launchctl start com.filemaker.fms
sudo service fmshelper start
logs\filemaker-jar-replacer-windows.loglogs/filemaker-jar-replacer-macos.loglogs/filemaker-jar-replacer-ubuntu.logThis project includes comprehensive test suites for all platforms to ensure reliability and security.
The project uses different testing frameworks for each platform:
macOS (using Homebrew):
brew install bats-core
Ubuntu/Debian:
# Install via package manager
sudo apt update
sudo apt install bats
# Or install latest version from source
git clone https://github.com/bats-core/bats-core.git
cd bats-core
sudo ./install.sh /usr/local
Manual Installation (any Unix-like system):
git clone https://github.com/bats-core/bats-core.git
cd bats-core
sudo ./install.sh /usr/local
Pester comes pre-installed with PowerShell 5.1+ and Windows PowerShell, but you may want to update to the latest version:
# Check current version
Get-Module -Name Pester -ListAvailable
# Install/Update to latest version (PowerShell 5.1+)
Install-Module -Name Pester -Force -SkipPublisherCheck
# For PowerShell Core (7+)
Install-Module -Name Pester -Scope CurrentUser
# Run specific BATS test file (Linux/macOS)
bats tests/backup-creation.bats
bats tests/version-detection.bats
# Run specific Pester test file (Windows)
Invoke-Pester tests/windows/Integration.Tests.ps1
Invoke-Pester tests/windows/Utilities.Tests.ps1
# Run all BATS tests (Linux/macOS)
bats tests/*.bats
# Run all Pester tests (Windows)
Invoke-Pester tests/windows/
The test suite includes:
Tests create isolated temporary environments and do not affect your system or FileMaker installation. However, some tests may require:
This JAR replacer is provided as-is for addressing CVE-2025-46295. Use in accordance with your FileMaker Server license agreement and Apache Commons license terms.