VulnerabilityAnalyzed

CVE-2025-46295

Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could potentially achieve remote code execution.

CRITICAL 9.8EPSS 1.04%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.04%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could potentially achieve remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.04% probability · 62th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: claris/filemaker server
Source: product-security@apple.com

References

https://support.claris.com/s/answerview?anum=000049059&language=en_USVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.