CVE-2026-73698 FileRun CVE debrief

Who should care

Administrators and users of FileRun versions prior to 2026.3.0 should assess exposure and prioritize updating to the latest version. Security teams and vulnerability management teams should review the vulnerability and assess the risk to their organization. Operators and platform administrators should review the vulnerability and assess the impact on their systems.

Why it matters

This SQL injection vulnerability in FileRun allows delegated administrators to execute arbitrary SQL, potentially leading to privilege escalation and code execution. Defenders should prioritize updating to version 2026.3.0 or later.

• Privilege escalation from delegated administrator to superuser
• Potential code execution via unsanitized path values

Technical summary

The vulnerability exists in the getValuesString() method in DB/DP.php, where raw array values are interpolated directly into an INSERT statement without parameterization. This allows delegated or simple administrators to execute arbitrary SQL, potentially leading to privilege escalation and code execution via unsanitized path values passed to require_once in the logs listing component. The underlying PDO connection uses emulated prepared statements enabling stacked queries, which allows attackers to manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges.

Defensive priority

High

Recommended defensive actions

• Review and update FileRun to version 2026.3.0 or later
• Restrict administrative access to trusted users
• Monitor logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the getValuesString() method in DB/DP.php interpolating raw array values directly into an INSERT statement without parameterization. The underlying PDO connection uses emulated prepared statements enabling stacked queries. This allows delegated or simple administrators to execute arbitrary SQL, potentially leading to privilege escalation and code execution via unsanitized path values passed to require_once in the logs listing component. Evidence is limited to public CVE details and FileRun source code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.