CVE-2026-73694

FileRun before 2026.3.0 contains an OS command injection flaw (CWE-78) caused by a no-op redefinition of escapeshellcmd() in CLI.php, which strips shell-metacharacter escaping and lets attacker-controlled input reach an exec() sink unsanitized. The flaw can be triggered interactively via image_preview.php with a crafted args parameter, which requires superuser authentication, or persistently by planting payloads in the thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss settings, which then execute whenever any user triggers video thumbnail generation. Successful exploitation yields arbitrary OS command execution with the privileges of the web application, giving attackers access to the file-hosting server and its stored files. All FileRun deployments running versions prior to 2026.3.0 are affected. The flaw is not in CISA KEV and no public proof-of-concept is known, so no confirmed in-the-wild exploitation has been reported.

What to do: Upgrade FileRun to 2026.3.0 or later, which restores proper shell escaping. Until patched, restrict superuser access to the instance and audit the thumbnails_ffmpeg_args and thumbnails_ffmpeg_ss settings for unexpected or planted values, since those persist and can fire under any user's thumbnail-generation activity. Admins who cannot upgrade should limit exposure of image_preview.php (e.g., via access controls or reverse-proxy rules) and review web-server logs for unexpected command execution.