CVE-2026-73693

FileRun before 2026.3.0 is vulnerable to OS command injection (CWE-78) in the PhotoProofSheet handler, caused by missing escapeshellarg() sanitization when filenames are inserted into the ImageMagick montage command line. An authenticated user with upload permission triggers the flaw by uploading a file whose name contains shell metacharacters such as backticks, semicolons, or $() command-substitution sequences, and then invoking the PhotoProofSheet endpoint, which executes the injected commands. Successful exploitation yields arbitrary command execution as the web-server user, giving the attacker control over the web application's process context, files, and any credentials or data accessible to that user. All FileRun deployments running a version prior to 2026.3.0 are affected, with practical exposure limited to instances where outside users hold upload-capable accounts. No public proof-of-concept, entry in CISA's KEV catalog, or reports of in-the-wild exploitation are known at this time.

What to do: Upgrade FileRun to version 2026.3.0 or later, which adds proper shell escaping in the PhotoProofSheet/ImageMagick command construction. Until patched, restrict upload permission to trusted accounts, consider blocking shell metacharacters in filenames at a reverse proxy or WAF, and review logs for unexpected commands run by the web-server user (e.g., unexpected ImageMagick/montage child processes).