Claris FileMaker Cloud Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Claris FileMaker Cloud. This issue allowed users with Admin Console privileges to bypass restrictions on OS Script schedule types, enabling them to execute arbitrary operating system commands on the host machine. The vulnerability affects FileMaker Cloud 2025 and has been addressed in version 2.22.0.5, which has been automatically applied to all instances.

Impact

Exploitation of this vulnerability allowed for arbitrary execution of operating system commands on the underlying host.

Remediation

Users can confirm their FileMaker Cloud instance has been updated by checking the version in the FileMaker Cloud Admin Console. The latest version should be 2.22.0.5 or any subsequent version.