CVE-2026-14863

Name of the Vulnerable Software and Affected Versions FileRun versions prior to 2026.2.1

Description Authenticated attackers can achieve remote code execution through an OS command injection. The issue occurs when the thumbnail generation system passes filenames wrapped in shell double-quotes directly to the exec() function without using escapeshellarg() sanitization. This allows filenames containing shell command substitution sequences, such as $(PAYLOAD).mp4, to bypass the filename sanitizer and be executed as shell commands when processed by ffmpeg, ImageMagick, vips, or stl-thumb.

Recommendations Update FileRun to a version later than 2026.2.0.