{"id":"CVE-2026-14863","title":"FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command subst…","summary":"FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command subst…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"published":"2026-08-11","updated":"2026-09-16","sourceUpdated":"2026-09-16T13:42:42.700","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14863","references":[{"url":"https://filerun.com/","label":"disclosure@vulncheck.com"},{"url":"https://filerun.com/index.php/changelog?v=2026.2.1","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/filerun-rce-via-thumbnail-generation-command-injection","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/blog/filerun-thumbnail-command-injection-rce","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.01654,"epssPercentile":0.7554,"ingestedAt":"2026-09-16T13:56:12.586Z","slug":"CVE-2026-14863","body":"## Overview\n\nFileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD).mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}