CVE-2026-73694 in FileRun
Summary
by MITRE • 09/10/2026
FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in FileRun versions prior to 2026.3.0 represents a critical OS command injection flaw rooted in the improper handling of shell metacharacters within the application's PHP codebase. Specifically, the issue stems from a no-op redefinition of the escapeshellcmd function located in the CLI.php module. In standard PHP environments, escapeshellcmd is designed to escape characters that have special meaning in the shell environment, such as semicolons, ampersands, and backticks, thereby preventing these characters from being interpreted by the operating system's command interpreter. However, within this specific implementation of FileRun, the function was redefined to perform no operation, effectively stripping away the critical layer of input sanitization that should have protected downstream commands. This architectural flaw allows attacker-controlled input to pass through without any modification or escaping, directly reaching an exec() sink where it is executed by the underlying operating system with the privileges of the web server process.
The operational impact of this vulnerability is severe due to its potential for both interactive and persistent exploitation paths. In the interactive scenario, an authenticated superuser can exploit the flaw through image_preview.php by supplying a crafted args parameter that contains malicious shell commands. Because the input reaches the exec() function unsanitized, these commands are executed immediately upon processing the request. This path requires high-level privileges but allows for immediate remote code execution if such credentials are compromised. More concerning is the persistent exploitation vector involving video thumbnail generation. Attackers can store malicious payloads in specific database fields or configuration parameters named thumbnails_ffmpeg_args and thumbnails_ffmpeg_ss. These values are typically used to pass arguments to FFmpeg, a popular multimedia framework. When any user, regardless of their privilege level, triggers the generation of a video thumbnail, the application retrieves these stored values and passes them directly into an OS command execution context without validation. This means that once the initial injection is achieved by a privileged account or through another vulnerability, subsequent actions by low-privilege users can trigger code execution, significantly expanding the attack surface and impact scope across the entire user base.
From a classification perspective, this flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The root cause is directly attributable to CWE-20 Incorrect Input Validation, where the application fails to properly neutralize special elements that could modify command structure or intent. Furthermore, the exploitation technique maps closely to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059 which covers various scripting languages including shell commands used for lateral movement and persistence. The ability to inject arbitrary code via FFmpeg arguments also touches upon supply chain logic risks where trusted tools are manipulated to execute unintended actions.
Mitigation strategies must prioritize immediate patching of the FileRun installation to version 2026.3.0 or later, which addresses this specific redefinition issue and restores proper input sanitization protocols. In environments where upgrading is not immediately feasible, administrators should implement strict web application firewall rules that detect and block common shell metacharacters within HTTP parameters associated with image preview and video thumbnail endpoints. Additionally, restricting the execution privileges of the web server process to a least-privilege model can limit the impact of successful exploitation by preventing access to sensitive system files or network resources. Regular auditing of database fields used for command arguments is also recommended to detect any pre-existing persistent payloads that may have been injected prior to remediation.