CVE-2026-73698: FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the dfuserspermissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to requireonce in the logs listing component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRunto a version that resolves this vulnerability.Fixed in 2026.3.0 - Compensating control
Since FileRun before 2026.3.0 allows delegated/simple administrators to execute arbitrary SQL, restrict access to the Groups Add Action (and the delegated/simple administrator role) to trusted users until the FileRun upgrade to 2026.3.0 is completed.
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Delegated administrators and simple administrators can exploit the vulnerability. An attacker must be authenticated with one of these administrative roles.
What access can an attacker obtain through exploitation?
An attacker can execute arbitrary SQL and modify the df_users_permissions table to elevate a delegated administrator account to superuser privileges. The issue may also enable code execution through unsanitized path values used by the logs listing component.
What input triggers the SQL injection?
The vulnerable path is the Groups Add action when the description parameter is submitted as an array. Raw array values are interpolated into an INSERT statement without parameterization.
What version addresses the issue?
FileRun 2026.3.0 addresses the vulnerability; versions before 2026.3.0 are affected.