CVE-2026-73694Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-10); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Full discourse2 posts

Threat Landscape@LandscapeThreat46d
Disclosure
VulnCheck disclosed four FileRun vulnerabilities enabling remote code execution and privilege escalation before version 2026.3.0. CVE-2026-73693 permits command substitution through uploaded filenames in the contact-sheet handler, while CVE-2026-73694 enables shell commands through the superuser FFmpeg test endpoint. CVE-2026-73698 allows delegated administrators to inject stacked SQL statements; chained with unsafe permission deserialization (CVE-2026-73699), it enables webshell deployment and code execution without superuser privileges. FileRun 2026.2.1 did not remediate the two command injections. Version 2026.3.0, released September 6, 2026, fixes all four vulnerabilities and removes shell interpretation from external-program calls.
Post summary
VulnCheck disclosed four critical FileRun vulnerabilities with detailed exploitation vectors, and FileRun released a patch (2026.3.0) to remediate them.
0001040
70 followersView on X
Vacation Vacation@ourvacations12324d
Disclosure
CVE-2026-73694 FileRun CLI CLI.php escapeshellcmd os command injection A vulnerability was detected in FileRun up to 2026.2.x. This vulnerability was named CVE-2026-73694. The affected component shou
Post summary
The text discloses CVE-2026-73694, an OS command injection vulnerability in FileRun CLI's CLI.php component affecting versions up to 2026.2.x, but provides no details about PoC, exploit, patch, or active exploitation.
0000020
25 followersView on X

Explore more

Back to dashboard