CVE-2026-73699

FileRun before 2026.3.0 contains a PHP object injection vulnerability (CWE-502) in the Perms::getPerms() method, which calls unserialize() without the named-key option required to disable arbitrary class instantiation. An authenticated attacker — CVSS 4.0 rates the required privileges as high — who can write to the database can inject a serialized gadget chain into permissions table columns that are deserialized on every authenticated page load. Deserializing the injected chain allows the attacker to write arbitrary files, such as a PHP webshell, to web-accessible paths, achieving remote code execution on the web server. All self-hosted FileRun deployments running versions prior to 2026.3.0 are affected. No public proof-of-concept or reports of in-the-wild exploitation are currently known, and the flaw is not listed in CISA's KEV.

What to do: Upgrade FileRun to version 2026.3.0 or later. Because exploitation requires a privileged authenticated account plus database write access, review privileged accounts and database write paths, and audit the permissions tables for unexpected serialized PHP objects or unfamiliar data. Restrict database write access to the application account until patched.