High

A newly disclosed vulnerability in Apache Commons Text, tracked as CVE-2025-46295, has been identified as a high-severity remote code execution (RCE) flaw. The issue affects Apache Commons Text versions prior to 1.10.0 and arises from unsafe interpolation features within the library. When applications process untrusted user input through the text-substitution API, attackers can exploit this behavior to execute arbitrary code or interact with external resources, potentially leading to full system compromise. Given Apache Commons Text’s widespread use in Java-based applications, the exposure risk is significant.

The vulnerability stems from the library’s interpolation mechanism, which dynamically evaluates expressions and can reference external data sources. If user-controlled data is embedded in these interpolation functions without proper validation, attackers can craft malicious payloads that trigger unintended expression evaluation. This makes the flaw particularly dangerous in server-side environments and internet-facing applications where external input is commonly processed, turning a utility library into a critical attack vector.

Claris has confirmed that FileMaker Server 2025 was impacted due to its use of Apache Commons Text. The issue has been fully mitigated in FileMaker Server version 22.0.4, where the library has been upgraded to Apache Commons Text 1.14.0. Users running older versions remain vulnerable and are strongly advised to apply updates immediately. Claris also acknowledged and credited an anonymous researcher for responsibly reporting the flaw.

The discovery of CVE-2025-46295 highlights the broader risks associated with transitive dependencies in modern software supply chains. Even indirectly used libraries can introduce severe security weaknesses if not regularly maintained. Security teams should conduct dependency audits, perform vulnerability scans across all projects, and ensure that no vulnerable versions of Apache Commons Text remain in their environments. Prompt patching and continuous dependency monitoring are critical to preventing exploitation of this high-impact RCE vulnerability.