CVE-2025-46295 (CVSS 9.8): Critical Apache Commons Text Flaw Risks Total Server Takeover

CVE-2025-46295, rated CVSS 9.8, is a critical Apache Commons Text flaw that could have enabled remote code execution across unpatched systems, according to the article. The vulnerability stems from the library’s string interpolation features, with versions prior to 1.10.0 allowing untrusted input to be fed directly into the text-substitution API.

The advisory notes that some interpolators could trigger actions such as executing commands or accessing external resources, creating a risk comparable to past high-profile RCE flaws. The impact was felt by FileMaker Server, which the article states relies on the library for its operations, and the development team has confirmed the issue is fully addressed in FileMaker Server 22.0.4. To close the door on the exploit, the underlying Apache Commons Text component has been upgraded to version 1.14.0. Administrators are urged to patch promptly to ensure the security of their FileMaker Server deployments.