CVE-2026-73698

FileRun before 2026.3.0 contains a SQL injection flaw (CWE-89) in its database helper code: when the description parameter is submitted as an array, the getValuesString() method in DB/DP.php interpolates the raw array values directly into an INSERT statement without parameterization. Delegated or simple administrators can trigger it by submitting a crafted array-typed description value, and because the underlying PDO connection uses emulated prepared statements, stacked queries are possible. An attacker gains arbitrary SQL execution, which can be used to modify the df_users_permissions table and escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution through unsanitized path values passed to require_once in the logs listing component. Any self-hosted FileRun deployment running a version earlier than 2026.3.0 is affected, with the highest risk where administrative rights are delegated to less-trusted accounts. The flaw is rated 8.6 (High) under CVSS 4.0, is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

What to do: Upgrade FileRun to version 2026.3.0 or later. As an interim measure, restrict delegated and simple administrator accounts to trusted operators and consider WAF rules that reject array-valued description parameters or stacked-query syntax (e.g., semicolons) on administrative endpoints. Audit the df_users_permissions table for unexpected superuser grants and review administrator activity around the logs listing component for signs of tampering.