CVE-2026-73699: FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into the permissions table columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRunto a version that resolves this vulnerability.Fixed in 2026.3.0Patch FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms() - Compensating control
If you can’t immediately upgrade, restrict database write access so authenticated attackers cannot inject serialized gadget chains into the permissions table columns processed on page loads.
Event History
Frequently Asked Questions
Who can realistically exploit this vulnerability?
An attacker must be authenticated and have database write access. They can place a serialized gadget chain in permissions-table columns that are processed during authenticated page loads.
Does exploitation require a victim to perform a specific action?
No user interaction is required. The affected permissions data is processed on every authenticated page load, so exploitation is triggered when an authenticated page is loaded.
What is the likely impact of successful exploitation?
Successful exploitation allows arbitrary code execution. An attacker can write arbitrary files, including PHP webshells, to web-accessible locations.
What version resolves the issue?
FileRun 2026.3.0 resolves the issue; versions before 2026.3.0 are affected.