PT-2025-51764 · Apache+2 · Apache Commons Text+2

CVE-2025-46295 · Published 2025-12-16 · Updated 2026-02-24

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Commons Text versions prior to 1.10.0 FileMaker Server versions prior to 22.0.4

Description Apache Commons Text versions prior to 1.10.0 contain interpolation features that could be exploited when applications process untrusted input using the text-substitution API. Certain interpolators can trigger actions, including executing commands or accessing external resources, potentially allowing an attacker to achieve remote code execution. The vulnerability has been addressed in FileMaker Server 22.0.4.

Recommendations Apache Commons Text versions prior to 1.10.0: Update to version 1.10.0 or later. FileMaker Server versions prior to 22.0.4: Update to version 22.0.4 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-16425

CVE-2025-46295

Affected Products

Apache Commons Text

Filemaker Server

Red Os

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2025-46295 · Security Note
• https://support.claris.com/s/answerview?anum=000049059&language=en_US · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46295 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16425 · Security Note
• https://t.me/pentestingnews/71782 · Telegram Post
• https://twitter.com/CVEnew/status/2001350874451579106 · Twitter Post
• https://twitter.com/threatcluster/status/2001608473671250052 · Twitter Post
• https://twitter.com/dateimacher/status/2011749928603959313 · Twitter Post
• https://github.com/advisories/GHSA-9gm8-6rq9-qj6f · Note
• https://t.me/CVEtracker/39984 · Telegram Post
• https://twitter.com/Komodosec/status/2015138936130252895 · Twitter Post
• https://reddit.com/r/filemaker/comments/1pqf3aw/cve202546295 · Reddit Post
• https://twitter.com/CCBalert/status/2001326602127364594 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-apache-commons-text-cve-2025-46295-8.0 · Note
• https://twitter.com/autumn_good_35/status/2001359812387573841 · Twitter Post