CVE-2026-43752

MEDIUM

Claris FileMaker Server < 26.0.1 - Arbitrary Code Execution

Title source: rule

Description

An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the Admin Console. This vulnerability has been addressed in FileMaker Server 26.0.1.

References (1)

Core 1

Core References

https://community.claris.com/en/s/article/Arbitrary-Code-Execution-Vulnerability-Addressed-in-FileMaker-Server-via-Miniforge-Installer-Upload

Scores

CVSS v3 4.9

EPSS 0.0029

EPSS Percentile 21.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-434

Status published

Products (2)

Claris/FileMaker Server < 26.0.1

claris/filemaker_server < 26.0.1

Published Jul 09, 2026

Tracked Since Jul 09, 2026