---
id: CVE-2026-73694
title: >-
  FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op
  Redefinition
summary: >-
  FileRun before 2026.3.0 contains an OS command injection vulnerability caused
  by a no-op redefinition of escapeshellcmd() in CLI.php that strips
  shell-metacharacter escaping, allowing attacker-controlled input to reach an
  exec() sink uns…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: FileRun
product: FileRun
affected:
  - FileRun < 2026.3.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-11T18:58:07.669443Z'
exploitAvailable: true
published: '2026-09-10'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T18:58:15.999Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-73694'
references:
  - url: >-
      https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce
    label: VulnCheck Blog
  - url: 'https://filerun.com/index.php/changelog?v=2026.3.0'
    label: Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/filerun-os-command-injection-via-escapeshellcmd-no-op-redefinition
tags:
  - cve.org
  - exploit-available
epss: 0.02237
epssPercentile: 0.82064
ingestedAt: '2026-09-14T00:35:28.534Z'
---

## Overview

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

## Affected

- `FileRun < 2026.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.