These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A SQL injection vulnerability exists in FileRun before version 2026.3.0, allowing delegated or simple administrators to execute arbitrary SQL by manipulating the description parameter. This can lead to privilege escalation and potential code execution. The vulnerability is caused by the getValuesString() method in DB/DP.php interpolating raw array values directly into an INSERT statement without parameter [truncated]
CVE-2026-73694 is an OS command injection vulnerability in FileRun before version 2026.3.0. The vulnerability is caused by a no-op redefinition of escapeshellcmd() in CLI.php, which allows attacker-controlled input to reach an exec() sink unsanitized. This vulnerability can be exploited through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or t [truncated]
CVE-2026-14863 is an OS command injection vulnerability in FileRun version 2026.2.0 and earlier. An authenticated attacker can achieve remote code execution by uploading a file with a malicious filename. The vulnerability exists because the thumbnail generation system passes filenames to exec() without proper sanitization, allowing filenames wrapped in shell double-quotes to be evaluated as shell commands [truncated]