CVE-2026-73698

FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action

No known exploitation. EPSS puts it in the 48th percentile. No fix published yet.

CVSS 3.17.2High EPSS percentile48th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-10Updated 2026-09-15Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check the installed FileRun version and identify all administrator or delegated-administrator accounts.
Upgrade FileRun to version 2026.3.0.
Until upgraded, restrict administrator access to trusted staff and remove unnecessary delegated-administrator accounts.
Review recent group changes, permission changes, and unfamiliar administrator accounts after upgrading.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to require_once in the logs listing component.

In plain language

Written by AI from the record

FileRun before 2026.3.0 lets a malicious or compromised administrator take over the system, so small businesses using it should act now.

Authenticated SQL injection in FileRun’s Groups Add action allows high-privilege users to inject stacked database commands through array-formatted description input and potentially escalate to full control.

If you're affected

Full FileRun takeover
Permission changes
File access exposure
Potential code execution
Service disruption

What is it

This is a flaw in the part of FileRun used to add groups. It can let a trusted administrator slip harmful instructions into the system’s records, like someone with a building manager’s key using it to make copies of every key and rewrite the access list.

Who is affected

This matters if your business uses FileRun and gives administrator or delegated-administrator access to staff, contractors, or an external IT provider. It is only a risk if an attacker already has a high-level FileRun login.

How urgent is it

An attacker with a high-level administrator account can use this remotely to change permissions and gain full control, so treat this as urgent. There is no confirmed public exploitation or public exploit code, but the possible impact warrants prompt remediation.

What to do — in detail

Confirm the deployed FileRun release in the administrative interface or application installation records, then inventory administrator and delegated-administrator accounts. Upgrade to FileRun 2026.3.0, the available fixed release; validate the upgrade in a backup or test environment first and review the vendor changelog for any release-specific compatibility changes.

If the upgrade must wait, limit administrator access to named trusted personnel, remove unneeded delegated-administrator accounts, and restrict access to the FileRun administration interface through your network controls. Review group creation activity, changes to permission records, newly elevated accounts, and unusual log-file listing behavior. No CISA KEV remediation due date applies because this CVE is not listed in the KEV catalog.

Technical context

CVE-2026-73698 is CVSS 7.2 High (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), classified as CWE-89 SQL injection. A high-privilege authenticated user can submit list-format data through the Groups Add description field; insufficient sanitization and support for multiple database commands enable arbitrary SQL, including permission escalation. The findings also describe potential code execution through log-file handling that loads files from unvalidated input. EPSS is 0.4% (38th percentile) with a flat trend. It is not in CISA KEV, no clear dated in-the-wild exploitation has been reported, and no public exploit code is on record.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS48th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 48th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 5 days, from the signal feeds we watch.

2026-09-15Record updated
2026-09-10Publishedweakness classified, att&ck mapped, record updated

Affected products

FileRuncommercial
- FileRunOn-premEnterprise Software / document-mgmt

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Scored 7.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable