CVE-2026-73698 Details
Description
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to require_once in the logs listing component.
A SQL injection vulnerability has been identified in FileRun versions prior to 2026.3.0. This vulnerability allows delegated or simple administrators to execute arbitrary SQL by manipulating the description parameter as an array. The issue arises because the getValuesString() method in DB/DP.php interpolates raw array values directly into an INSERT statement without proper parameterization. Exploitation of this vulnerability enables attackers to escalate a delegated administrator account to superuser privileges by manipulating the df_users_permissions table. Additionally, it may lead to remote code execution through unsanitized path values passed to require_once in the logs listing component.
Users are advised to upgrade to FileRun version 2026.3.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce | CISA-ADP | BundleExploitRemedyTechnical Analysis |
| https://filerun.com/index.php/changelog?v=2026.3.0 | [email protected] | Release NotesVendor |
| https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/filerun-authenticated-sql-injection-via-groups-add-action | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileRun | < 2026.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |