Vulnerability · Published Dec 16, 2025 · Assigned by apple

CVE-2025-46295

Critical 9.8

In plain English

A critical-severity code injection in FileMaker Server from Claris. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.0%top 35.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could potentially achieve remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4.

Affected products (as reported)

Vendor	Product	Versions
Claris	FileMaker Server	unspecified – before 22.0.4

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://support.claris.com/s/answerview?anum=000049059&language=en_US