CVE-2026-73694

Name of the Vulnerable Software and Affected Versions FileRun versions prior to 2026.3.0

Description An OS command injection issue exists due to a no-op redefinition of the escapeshellcmd() function in CLI.php, which removes shell-metacharacter escaping and allows unsanitized input to reach an exec() sink. This can be exploited through an interactive path via the image preview.php endpoint using a crafted args parameter, which requires superuser authentication. Alternatively, it can be exploited through a persistent path by storing malicious payloads in the thumbnails ffmpeg args or thumbnails ffmpeg ss variables, which execute when any user triggers video thumbnail generation.

Recommendations Update to version 2026.3.0 or later. Restrict access to the image preview.php endpoint and avoid using the args parameter until the update is applied. Avoid modifying the thumbnails ffmpeg args and thumbnails ffmpeg ss variables until the update is applied.