CVE-2026-73698 in FileRun
Summary
by MITRE • 09/10/2026
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to require_once in the logs listing component.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
FileRun versions prior to 2026.3.0 are susceptible to a critical SQL injection vulnerability that stems from improper input validation within the database interaction layer. The flaw is located specifically in the getValuesString() method found in the DB/DP.php file, which handles data insertion operations. When an administrator submits the description parameter as an array rather than a scalar value, the application fails to sanitize or properly escape these inputs before interpolating them directly into SQL INSERT statements. This lack of parameterization allows attackers to inject arbitrary SQL commands that are executed by the underlying database engine. The vulnerability is particularly severe because it affects both simple administrators and delegated administrators, providing a broad attack surface for authenticated users who may have limited privileges but sufficient access to trigger this specific code path.
The operational impact of this vulnerability extends beyond standard data manipulation due to the configuration of the PHP Data Objects (PDO) connection used by FileRun. The system employs emulated prepared statements rather than native ones, which inadvertently enables stacked queries. This architectural choice allows an attacker to append additional SQL commands after the initial injection point, effectively bypassing single-statement restrictions. By exploiting this capability, a delegated administrator can directly manipulate the df_users_permissions table in the database backend. Through precise manipulation of permission flags and role identifiers within this table, an attacker can escalate their account privileges from a limited delegated status to that of a superuser with full administrative control over the FileRun instance.
Beyond privilege escalation, the vulnerability chain facilitates remote code execution through secondary exploitation vectors linked to file system operations. The unsanitized path values associated with the injected data are subsequently passed to require_once functions within the logs listing component. Because these paths are not validated against expected directory structures or allowed characters, an attacker can craft malicious inputs that point to arbitrary files on the server filesystem. When the application attempts to include these files for logging purposes, it effectively executes code contained within those files if they exist and are accessible. This combination of SQL injection leading to privilege escalation and subsequent file inclusion represents a critical security failure that compromises the confidentiality, integrity, and availability of the entire system.
From an industry standards perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific mechanism involving emulated prepared statements enabling stacked queries is a classic example of how configuration choices can exacerbate input validation flaws. Furthermore, the privilege escalation aspect maps to ATT&CK technique T1078, Valid Accounts, specifically focusing on Local Account Manipulation or Privilege Escalation within an application context. The subsequent code execution via file inclusion relates to CWE-94 and potentially ATT&CK techniques involving Command Line Interface exploitation or File Inclusion attacks depending on the exact payload delivery method.
To mitigate this vulnerability, organizations running FileRun must immediately upgrade to version 2026.3.0 or later where these input validation issues have been addressed. Until an upgrade is feasible, administrators should restrict access to the application by placing it behind a Web Application Firewall that can detect and block SQL injection patterns in array parameters. Additionally, reviewing database configurations to disable emulated prepared statements if possible may reduce the risk of stacked query exploitation, although this requires careful testing as it may impact other parts of the application logic. Regular audits of user permissions and monitoring for unusual changes in permission tables such as df_users_permissions can also help detect potential exploitation attempts early. Ensuring that file inclusion paths are strictly validated against a whitelist of allowed directories provides an additional layer of defense against secondary code execution vectors.