CVE-2026-73698
Received Received - Intake

FileRun SQL Injection Leading to Privilege Escalation

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to require_once in the logs listing component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-73698
EUVD
EUVD-2026-75600

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filerun filerun to 2026.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73698 is a SQL injection vulnerability in FileRun, a self-hosted file management platform. It allows delegated administrators to inject raw SQL commands by submitting a field as an array instead of text. The application fails to enforce string types for database fields, enabling SQL injection through the description parameter. This flaw can be exploited to manipulate the df_users_permissions table, escalating privileges from delegated admin to superuser. The vulnerability exists because the getValuesString() method in DB/DP.php interpolates raw array values directly into SQL INSERT statements without proper parameterization.

Detection Guidance

To detect this vulnerability, check FileRun versions prior to 2026.3.0. Look for unauthorized SQL queries or unexpected privilege changes in logs. Test by submitting the description parameter as an array in affected fields to see if it triggers SQL errors or unexpected behavior.

Impact Analysis

If you are a delegated administrator on a vulnerable FileRun instance, an attacker with your access level could exploit this to escalate privileges to superuser, gaining full control over the system. This could lead to unauthorized data access, modification, or deletion. Additionally, the vulnerability may allow code execution by manipulating unsanitized path values in the logs listing component, potentially compromising the entire server. The impact includes complete system takeover and potential data breaches.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, and a breach could lead to regulatory fines. HIPAA mandates safeguarding protected health information; exploitation could result in violations and penalties. The ability to escalate privileges and execute arbitrary code increases the risk of data exposure, non-compliance, and legal consequences for affected organizations.

Mitigation Strategies

Immediately upgrade FileRun to version 2026.3.0 or later. If upgrading is not possible, restrict access to delegated administrator accounts and monitor database queries for suspicious activity. Disable stacked queries in PDO if supported.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73698. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart