CVE-2026-73694: FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via imagepreview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnailsffmpegargs or thumbnailsffmpegss that execute when any user triggers video thumbnail generation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the interactive path, and what input is involved?
The interactive path requires superuser authentication. An authenticated superuser can send a crafted args parameter through image_preview.php to reach the unsanitized exec() sink.
Can this be triggered persistently after malicious values are stored?
Yes. Malicious payloads stored in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss execute later when any user triggers video thumbnail generation.
Which deployments are affected?
FileRun versions before 2026.3.0 are affected. The provided information does not state whether the vulnerable thumbnail settings are enabled by default.