---
id: CVE-2026-14863
title: >-
  FileRun up to and including version 2026.2.0 contains an OS command injection
  vulnerability that allows authenticated attackers to achieve remote code
  execution by uploading a file with a malicious filename containing shell
  command subst…
summary: >-
  FileRun up to and including version 2026.2.0 contains an OS command injection
  vulnerability that allows authenticated attackers to achieve remote code
  execution by uploading a file with a malicious filename containing shell
  command subst…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-08-11'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:42.700'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14863'
references:
  - url: 'https://filerun.com/'
    label: disclosure@vulncheck.com
  - url: 'https://filerun.com/index.php/changelog?v=2026.2.1'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/filerun-rce-via-thumbnail-generation-command-injection
    label: disclosure@vulncheck.com
  - url: 'https://www.vulncheck.com/blog/filerun-thumbnail-command-injection-rce'
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.02539
epssPercentile: 0.84315
ingestedAt: '2026-09-16T13:56:12.586Z'
---

## Overview

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD).mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.