Product:
Claris FileMaker Cloud
Summary
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a front-end restriction on OS Script schedule types and execute arbitrary operating system commands on the underlying host. This issue is fixed in FileMaker Cloud 2.22.0.5.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2026-43680 |
Exploitation
To exploit this vulnerability, an attacker with Admin Console privileges can manipulate OS Script schedule types to bypass restrictions. By doing so, they can execute arbitrary commands on the underlying host, potentially leading to unauthorized access and control over the system.
Affected Products
- Claris FileMaker Cloud: Affected by the vulnerability allowing remote code execution through OS Script schedule manipulation.
Mitigation
To mitigate this vulnerability, users should upgrade to FileMaker Cloud version 2.22.0.5 or later. Additionally, it is recommended to review and restrict Admin Console privileges to minimize the risk of exploitation.