CVE-2026-73694

Deferred Deferred - Pending Action

FileRun OS Command Injection via CLI.php escapeshellcmd()

Publication date: 2026-09-10

Last updated on: 2026-09-11

Assigner: VulnCheck

Description

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-11

Generated

2026-10-01

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-73694

EUVD

EUVD-2026-75599

Affected Vendors & Products

Vendor	Product	Version / Range
filerun	filerun	to 2026.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

FileRun before version 2026.3.0 has an OS command injection flaw due to a no-op redefinition of escapeshellcmd() in CLI.php. This removes shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() function without proper sanitization.

Detection Guidance

Check FileRun versions prior to 2026.3.0 by inspecting the CLI.php file for a no-op redefinition of escapeshellcmd(). Look for suspicious entries in image_preview.php args parameter or modifications to thumbnails_ffmpeg_args and thumbnails_ffmpeg_ss files. Review system logs for unexpected exec() calls or thumbnail generation triggers.

Impact Analysis

Attackers can exploit this by sending crafted input via image_preview.php with a malicious args parameter (requiring superuser access) or by storing payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss. These payloads execute when video thumbnails are generated by any user.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful exploit may violate these regulations by enabling data breaches or unauthorized access.

Mitigation Strategies

Upgrade FileRun to version 2026.3.0 or later immediately. Remove any malicious payloads from thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss. Disable interactive path via image_preview.php if not required. Monitor system for signs of exploitation and restrict superuser access.

Hi! I’m here to help you understand CVE-2026-73694. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70