Product:
Claris FileMaker Cloud
Summary
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2026-43685 |
Exploitation
To exploit this vulnerability, an attacker with Admin Console privileges can send specially crafted input through the External ODBC Data Source connection test feature. This unsanitized input can lead to the execution of arbitrary operating system commands, potentially compromising the system’s integrity and confidentiality.
Affected Products
- Claris FileMaker Cloud: Affected by the Remote Code Execution vulnerability allowing command injection through the External ODBC Data Source connection test feature.
Mitigation
To mitigate this vulnerability, users should upgrade to FileMaker Cloud version 2.22.0.5 or later, which addresses the issue by sanitizing input in the affected feature. Regularly updating software and monitoring for security advisories can help prevent exploitation.