CVE-2025-46295

Critical

Published: 16/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Apache Commons Text before 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Some interpolators could trigger actions like executing commands or accessing external resources, potentially leading to remote code execution. This has been fully addressed in FileMaker Server 22.0.4.

Risk Assessment

An attacker could exploit this to achieve remote code execution in the context of the application, potentially leading to system compromise or data theft.

Recommendation

Upgrade Apache Commons Text to version 1.10.0 or later, and apply the fix in FileMaker Server 22.0.4.

Original NVD description (English source)

Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could potentially achieve remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4.