CVE Explorer
CVE-2026-43752
An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the Admin Console. This vulnerability has been addressed in FileMaker Server 26.0.1.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1
Preserved source conflicts
No provider value was silently selected as the winner.
cwe · 2 assertions
{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:dba65297f58b66173aeda6dfb572ad3acde863350b0693d40d264cf97ebf4fb3 · sha256:6d680d44e0b3ac0d… · /containers/adp/0/problemTypes/0/descriptions/0
{"description":"An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the Admin Console.","lang":"en"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:dba65297f58b66173aeda6dfb572ad3acde863350b0693d40d264cf97ebf4fb3 · sha256:6d680d44e0b3ac0d… · /containers/cna/problemTypes/0/descriptions/0
Affected products and versions
1 source assertion{"product":"FileMaker Server","vendor":"Claris","versions":[{"lessThan":"26.0.1","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:dba65297f58b66173aeda6dfb572ad3acde863350b0693d40d264cf97ebf4fb3 · sha256:6d680d44e0b3ac0d… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:dba65297f58b66173aeda6dfb572ad3acde863350b0693d40d264cf97ebf4fb3 · sha256:6d680d44e0b3ac0d… · /containers/adp/0/metrics/0/cvssV3_1
CWE assertions
2 source assertions{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:dba65297f58b66173aeda6dfb572ad3acde863350b0693d40d264cf97ebf4fb3 · sha256:6d680d44e0b3ac0d… · /containers/adp/0/problemTypes/0/descriptions/0
{"description":"An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the Admin Console.","lang":"en"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:dba65297f58b66173aeda6dfb572ad3acde863350b0693d40d264cf97ebf4fb3 · sha256:6d680d44e0b3ac0d… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"url":"https://community.claris.com/en/s/article/Arbitrary-Code-Execution-Vulnerability-Addressed-in-FileMaker-Server-via-Miniforge-Installer-Upload"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:dba65297f58b66173aeda6dfb572ad3acde863350b0693d40d264cf97ebf4fb3 · sha256:6d680d44e0b3ac0d… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.