A flaw in the External ODBC Data Source connection test feature of Claris FileMaker Cloud enables an administrator with access to the Admin Console to inject arbitrary operating system commands. By supplying unsanitized input, an attacker can execute any OS command on the underlying infrastructure, leading to complete compromise of confidentiality, integrity, and availability of the cloud instance.

Claris FileMaker Cloud is affected by this vulnerability. The fix is available in version 2.22.0.5; all prior Cloud instances lacking this update are vulnerable. No specific earlier versions are listed, so any Cloud deployment before 2.22.0.5 is considered impacted.

The exploit requires Admin Console privileges, so it is limited to users with elevated access. The CVSS score is 7.2. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Remote code execution allows attackers full control over the host once they authenticate.