CVE-2026-73693: FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command substitution syntax such as backticks, semicolons, or $() sequences in the filename, then trigger the PhotoProofSheet endpoint to execute arbitrary commands as the web-server user due to missing escapeshellarg() sanitization in the ImageMagick montage command construction.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have permission to upload files. They also need to be able to trigger the PhotoProofSheet endpoint after uploading a file.
What access does successful command execution provide?
Commands execute as the web-server user. The vulnerability can affect confidentiality, integrity, and availability at that privilege level.
Are installations running the fixed release affected?
The issue affects FileRun versions before 2026.3.0. FileRun 2026.3.0 is identified as the fixed version.
What can be monitored to identify exploitation attempts?
Review uploaded filenames for shell metacharacters or command-substitution syntax, including backticks, semicolons, and $() sequences. Correlate those uploads with requests to the PhotoProofSheet endpoint and unexpected processes launched by the web-server user.