FileRun up to 2026.2.1 Logs Listing DB/DP.php getValuesString Description sql injection

Summaryinfo

A vulnerability was found in FileRun. It has been classified as problematic. The affected element is the function getValuesString of the file DB/DP.php of the component Logs Listing Component. The manipulation of the argument Description leads to sql injection. This vulnerability is referenced as CVE-2026-73698. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in FileRun. It has been rated as problematic. This issue affects the function getValuesString of the file DB/DP.php of the component Logs Listing Component. The manipulation of the argument description with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to require_once in the logs listing component.

It is possible to read the advisory at vulncheck.com. The identification of this vulnerability is CVE-2026-73698 since 08/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

By approaching the search of inurl:DB/DP.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2026.3.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• FileRun

Version

• 1.0
• 2018.02.13
• 2019.05.21
• 2021.03.26
• 2026.2.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion