VulnSocial

CVE-2026-73698Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to require_once in the logs listing component.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-10: 1Patch / Workaround · 2026-09-10: 1Technical Details · 2026-09-10: 109-10
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Threat Landscape@LandscapeThreat
    Disclosure

    VulnCheck disclosed four FileRun vulnerabilities enabling remote code execution and privilege escalation before version 2026.3.0. CVE-2026-73693 permits command substitution through uploaded filenames in the contact-sheet handler, while CVE-2026-73694 enables shell commands through the superuser FFmpeg test endpoint. CVE-2026-73698 allows delegated administrators to inject stacked SQL statements; chained with unsafe permission deserialization (CVE-2026-73699), it enables webshell deployment and code execution without superuser privileges. FileRun 2026.2.1 did not remediate the two command injections. Version 2026.3.0, released September 6, 2026, fixes all four vulnerabilities and removes shell interpretation from external-program calls.

    Post summary

    Four FileRun vulnerabilities (CVE‑2026‑73693 to CVE‑2026‑73699) enabling RCE and privilege escalation were disclosed; mitigation is available in FileRun 2026.3.0.

    0001040
    70 followersView on X

Explore more

Back to dashboard