CVE-2026-73699

HIGH 7.2

FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into the permissions table columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths.

CWE	CWE-502
Vendor	filerun
Product	filerun
Published	Sep 10, 2026
Last Updated	Sep 10, 2026

Stay Ahead of the Next One

Get instant alerts for filerun filerun

Be the first to know when new high vulnerabilities affecting filerun filerun are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FileRun / FileRun

0 < 2026.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vulncheck.com: https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce filerun.com: https://filerun.com/index.php/changelog?v=2026.3.0 vulncheck.com: https://www.vulncheck.com/advisories/filerun-php-object-injection-via-perms-getperms

Credits

Valentin Lobstein (Chocapikk) VulnCheck