CVE-2026-73694 Details
Description
FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.
A command injection vulnerability has been identified in FileRun versions prior to 2026.3.0. This vulnerability arises from a no-op redefinition of the escapeshellcmd() function in CLI.php, which removes the proper escaping of shell metacharacters. As a result, attacker-controlled input can reach an exec() function unsanitized. Exploitation can occur through an interactive path via image_preview.php, where a crafted args parameter is accepted, or through a persistent path by embedding malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss, which are executed during video thumbnail generation.
Users are advised to update to FileRun version 2026.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://filerun.com/index.php/changelog?v=2026.3.0 | [email protected] | Release NotesVendor |
| https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/filerun-os-command-injection-via-escapeshellcmd-no-op-redefinition | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileRun | < 2026.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |