CVE-2026-73694 FileRun CVE debrief

Who should care

Administrators and users of FileRun versions prior to 2026.3.0 should assess their exposure and take necessary actions to prevent exploitation. This includes reviewing system configurations, monitoring for suspicious activity, and prioritizing patching or mitigation efforts. Additionally, security teams and vulnerability management teams should be aware of the potential risks and impacts of this vulnerability on their systems and take proactive measures to

Why it matters

CVE-2026-73694 is a high-severity OS command injection vulnerability in FileRun that requires immediate attention from administrators and users of affected versions. The vulnerability can be exploited through multiple vectors, including interactive and persistent paths. Defenders should prioritize patching or mitigating the vulnerability to prevent potential code execution and unauthorized access.

• Potential code execution on vulnerable systems
• Possible unauthorized access to sensitive data
• Required verification of FileRun version and patch level
• Necessity for monitoring and incident response planning

Technical summary

The vulnerability is caused by a no-op redefinition of escapeshellcmd() in CLI.php, which allows attacker-controlled input to reach an exec() sink unsanitized. This can be exploited through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

Defensive priority

High

Recommended defensive actions

• Review and update FileRun to version 2026.3.0 or later
• Restrict access to image_preview.php and video thumbnail generation features
• Monitor for suspicious activity and implement additional security measures to prevent exploitation
• Perform vulnerability scanning to identify potentially exposed systems
• Review system logs for indicators of compromise
• Implement network segmentation to limit lateral movement
• Conduct a thorough risk assessment to prioritize patching

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and references. However, the vendor and product information is not well-defined, with the vendor name listed as 'Unknown Vendor' and the product name not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.