VulnCheck disclosed four FileRun vulnerabilities enabling remote code execution and privilege escalation before version 2026.3.0. CVE-2026-73693 permits command substitution through uploaded filenames in the contact-sheet handler, while CVE-2026-73694 enables shell commands through the superuser FFmpeg test endpoint. CVE-2026-73698 allows delegated administrators to inject stacked SQL statements; chained with unsafe permission deserialization (CVE-2026-73699), it enables webshell deployment and code execution without superuser privileges. FileRun 2026.2.1 did not remediate the two command injections. Version 2026.3.0, released September 6, 2026, fixes all four vulnerabilities and removes shell interpretation from external-program calls.
Post summary
The report announces four FileRun vulnerabilities that enable remote code execution and privilege escalation and notes that version 2026.3.0 successfully patches all issues.