CVE-2026-73694

FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition

No known exploitation. EPSS puts it in the 82nd percentile. No fix published yet.

CVSS 3.17.2High EPSS percentile82nd2.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-10Updated 2026-09-11Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run FileRun and confirm its installed version.
Upgrade FileRun to version 2026.3.0.
Review FileRun accounts and remove any unnecessary access.
Check video thumbnail settings for unexpected custom commands.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

In plain language

Written by AI from the record

FileRun versions before 2026.3.0 can let someone with a FileRun account take control of its server, so small businesses using it should act now.

Authenticated OS command injection in FileRun before 2026.3.0 allows direct superuser execution or delayed execution through attacker-controlled video-thumbnail settings.

If you're affected

Full server takeover
File access and theft
Business service disruption
Ransomware deployment

What is it

This is a flaw that can allow a FileRun user to send harmful instructions to the computer running the service. It is like a staff key that can be altered to unlock the building’s control room, not just the files the staff member should access.

Who is affected

This matters to you if your business runs FileRun before 2026.3.0. A superuser can trigger the issue directly, while a lower-privileged user can plant harmful thumbnail settings that run when someone views a video thumbnail; FileRun is reachable by default.

How urgent is it

An attacker who obtains or already has a FileRun account can use this flaw to take control of the server, which makes this a red-priority issue. There is no confirmed public report of active exploitation or public exploit code, but the affected service is network-accessible by default and the impact is severe.

What to do — in detail

Confirm the installed FileRun version and identify all FileRun instances exposed to users or the internet. Upgrade each affected instance to FileRun 2026.3.0; the available patch information identifies this as the fixed release, with no branch-specific alternative provided.

Before and after upgrading, review superuser and lower-privileged accounts, especially recently created accounts or unexpected permission changes. Inspect thumbnails_ffmpeg_args and thumbnails_ffmpeg_ss for unfamiliar values, and review server process and web-server logs for unexpected command execution or thumbnail-generation activity.

If an upgrade must be delayed, restrict FileRun access to trusted administrators and temporarily disable or tightly control video thumbnail generation and its custom settings. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies. Monitor for suspicious account activity, altered thumbnail settings, and unusual server processes until the upgrade is complete.

Technical context

CVE-2026-73694 is rated CVSS 7.2 (High): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. It is CWE-78 OS command injection: a no-op redefinition of escapeshellcmd() permits attacker-controlled input to reach an exec() sink without normal shell-metacharacter escaping. The direct image_preview.php path uses a crafted args parameter and requires superuser authentication; a persistent path stores payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss, executing when video thumbnail generation is triggered. EPSS is 1.8% (77th percentile) with a flat trend. The CVE is not in CISA KEV, there is no clear dated report of exploitation in the wild, and no public exploit code is on record.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS82nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

2.2% chance of exploitation activity in the next 30 days, which ranks it in the 82nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 1 day, from the signal feeds we watch.

2026-09-11Record updated
2026-09-10Publishedweakness classified, att&ck mapped, record updated

Affected products

FileRuncommercial
- FileRunOn-premEnterprise Software / document-mgmt

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Scored 7.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable