CVE-2026-43685

{
  "id": "CVE-2026-43685",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T23:16:17.973",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de ejecución remota de código en Claris FileMaker Cloud permitió a un usuario con privilegios de la Consola de Administración inyectar comandos arbitrarios del sistema operativo a través de una entrada no saneada en la función de prueba de conexión de la Fuente de Datos ODBC Externa. Este problema está solucionado en FileMaker Cloud 2.22.0.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Claris",
          "product": "FileMaker Cloud",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.22.0.5",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T00:17:08.446075Z",
          "id": "CVE-2026-43685",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:claris:filemaker_cloud:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.22.0.5",
              "matchCriteriaId": "A0DBAD4E-B906-4130-8D79-FBDD67974E60"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.claris.com/s/answerview?anum=000049154&language=en_US",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}