CVE-2026-73693

HIGH 8.8

FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command substitution syntax such as backticks, semicolons, or $() sequences in the filename, then trigger the PhotoProofSheet endpoint to execute arbitrary commands as the web-server user due to missing escapeshellarg() sanitization in the ImageMagick montage command construction.

CWE	CWE-78
Vendor	filerun
Product	filerun
Published	Sep 10, 2026
Last Updated	Sep 10, 2026

Stay Ahead of the Next One

Get instant alerts for filerun filerun

Be the first to know when new high vulnerabilities affecting filerun filerun are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FileRun / FileRun

0 < 2026.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vulncheck.com: https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce filerun.com: https://filerun.com/index.php/changelog?v=2026.3.0 vulncheck.com: https://www.vulncheck.com/advisories/filerun-os-command-injection-via-photoproofsheet-handler

Credits

Valentin Lobstein (Chocapikk) VulnCheck