---
id: CVE-2026-73699
title: 'FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()'
summary: >-
  FileRun before 2026.3.0 contains a PHP object injection vulnerability that
  allows authenticated attackers to execute arbitrary code by exploiting
  incorrect options passed to unserialize() in the Perms::getPerms() method,
  where a position…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-502
vendor: FileRun
product: FileRun
affected:
  - FileRun < 2026.3.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T17:09:42.870522Z'
exploitAvailable: true
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T17:11:17.675Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-73699'
references:
  - url: >-
      https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce
    label: VulnCheck Blog
  - url: 'https://filerun.com/index.php/changelog?v=2026.3.0'
    label: Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/filerun-php-object-injection-via-perms-getperms
tags:
  - cve.org
  - exploit-available
epss: 0.00538
epssPercentile: 0.44287
ingestedAt: '2026-09-11T14:42:19.869Z'
---

## Overview

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into the permissions table columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths.

## Affected

- `FileRun < 2026.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.