CVE-2026-73694

HIGH 7.2

FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

CWE	CWE-78
Vendor	filerun
Product	filerun
Published	Sep 10, 2026
Last Updated	Sep 11, 2026

Stay Ahead of the Next One

Get instant alerts for filerun filerun

Be the first to know when new high vulnerabilities affecting filerun filerun are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FileRun / FileRun

0 < 2026.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vulncheck.com: https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce filerun.com: https://filerun.com/index.php/changelog?v=2026.3.0 vulncheck.com: https://www.vulncheck.com/advisories/filerun-os-command-injection-via-escapeshellcmd-no-op-redefinition

Credits

Valentin Lobstein (Chocapikk) VulnCheck