CVE-2026-73694
Received Received - Intake

FileRun OS Command Injection via CLI.php escapeshellcmd()

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-73694
EUVD
EUVD-2026-75599

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filerun filerun to 2026.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FileRun before version 2026.3.0 has an OS command injection flaw due to a no-op redefinition of escapeshellcmd() in CLI.php. This removes shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() function without proper sanitization.

Detection Guidance

Check FileRun versions prior to 2026.3.0 by inspecting the CLI.php file for a no-op redefinition of escapeshellcmd(). Look for suspicious entries in image_preview.php args parameter or modifications to thumbnails_ffmpeg_args and thumbnails_ffmpeg_ss files. Review system logs for unexpected exec() calls or thumbnail generation triggers.

Impact Analysis

Attackers can exploit this by sending crafted input via image_preview.php with a malicious args parameter (requiring superuser access) or by storing payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss. These payloads execute when video thumbnails are generated by any user.

Mitigation Strategies

Upgrade FileRun to version 2026.3.0 or later immediately. Remove any malicious payloads from thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss. Disable interactive path via image_preview.php if not required. Monitor system for signs of exploitation and restrict superuser access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73694. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart