Read the docs
TI-2026-51761 Aliases CVE-2026-73693GHSA-63rx-6h5r-6rfp

FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command substitution syntax such as backticks, semicolons, or $() sequences in the filename, then trigger the PhotoProofSheet endpoint to execute arbitrary commands as the web-server user due to missing escapeshellarg() sanitization in the ImageMagick montage command construction.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0271 86th percentileScored 2026-11-07
Fix Fixed FileRun (FileRun): 2026.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FileRunFileRunbefore 2026.3.02026.3.0Patch availableCNA
  • FileRun VendorFileRun Affected before 2026.3.0 Fixed in 2026.3.0 Patch available CNA

Remediation

  • Fix · CNA FileRun (FileRun) Fixed in 2026.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FileRun 2026.3.0

    4 records Highest priority Priority HIGH 3 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-51764 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()Priority HIGH 72
    • TI-2026-51763 FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add ActionPriority HIGH 72
    • TI-2026-51762 FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op RedefinitionPriority HIGH 72
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73693
  2. 2026-10-03 Alias added: GHSA-63rx-6h5r-6rfp

References

Patch 1

  • TI-2026-51764 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms() CVSS 4.0HIGH 8.6
  • TI-2026-51763 FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action CVSS 4.0HIGH 8.6
  • TI-2026-51762 FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition CVSS 4.0HIGH 8.6
  • TI-2017-10801 FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability… CVSS 3.0CRITICAL 9.8
  • TI-2026-12531 FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection CVSS 4.0HIGH 8.7
  • TI-2022-23603 FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request. CVSS 3.1CRITICAL 9.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences