CVE-2026-14863

Received Received - Intake

FileRun OS Command Injection via Malicious Filename in Thumbnail Generation

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD).mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-14863

Affected Vendors & Products

Vendor	Product	Version / Range
filerun	filerun	to 2026.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

FileRun versions up to 2026.2.0 have an OS command injection flaw. Authenticated attackers can upload files with malicious filenames containing shell commands. When thumbnail generation processes these files, the system executes the embedded commands without proper sanitization, leading to remote code execution.

Detection Guidance

Check for uploaded files with suspicious filenames containing shell command sequences like $(PAYLOAD) or other substitution patterns. Review thumbnail generation logs for ffmpeg, ImageMagick, vips, or stl-thumb processes for unexpected command execution.

Impact Analysis

An attacker with access could execute arbitrary commands on the server, potentially stealing data, installing malware, or disrupting services. The attack requires authentication but can lead to full system compromise if thumbnail generation processes the malicious file.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using affected FileRun versions may face compliance violations and penalties.

Mitigation Strategies

Update FileRun to a version beyond 2026.2.0 where the vulnerability is patched. If immediate update is not possible, restrict file uploads to trusted users and monitor thumbnail generation processes for unusual activity.

Hi! I’m here to help you understand CVE-2026-14863. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70