Which versions of FileRun are affected by CVE-2026-73694?

Publicly available exploit code exists for a command injection vulnerability in FileRun versions before 2026.3.0 that enables administrative users to achieve complete server compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2026-73694?

Yes, a public proof-of-concept exploit is available for CVE-2026-73694. Prioritise patching immediately. EPSS: 1.8%.

How to fix or mitigate CVE-2026-73694?

Within 24 hours, inventory all FileRun deployments and identify instances running versions before 2026.3.0 for immediate remediation planning. Within 7 days, apply the vendor-released patch 2026.3.0 to all production and non-production FileRun systems after validating compatibility in a staging environment. Within 30 days, audit administrator access logs for suspicious command execution activity and review thumbnail generation settings (specifically thumbnails_ffmpeg_args and thumbnails_ffmpeg_ss parameters) for unauthorized FFmpeg configurations that may indicate prior compromise.

FileRun CVE-2026-73694

Q: What is the CVSS score of CVE-2026-73694?

CVE-2026-73694 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.8%.

EUVD-2026-75599 HIGH

OS Command Injection (CWE-78)

2026-09-10 VulnCheck

GHSA-5wmm-f68q-g9pg

PHP Command Injection Filerun

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-accessible exploit requires superuser credentials (PR:H); full C/I/A impact on the vulnerable host with no scope change to external systems.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 10, 2026 - 19:23 vuln.today

Analysis Generated

Sep 10, 2026 - 17:21 vuln.today

CVE Published

Sep 10, 2026 - 16:33 cve.org

HIGH 8.6

DescriptionCVE.org

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

AnalysisAI

OS command injection in FileRun before 2026.3.0 enables a network-accessible superuser to execute arbitrary commands on the underlying server, exploiting a deliberate no-op redefinition of PHP's escapeshellcmd() in CLI.php that strips all shell metacharacter escaping before attacker-controlled input reaches exec(). Two distinct exploitation paths exist: an immediate interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, and a more dangerous persistent backdoor path where malicious payloads stored by an admin in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss execute automatically whenever any user triggers video thumbnail generation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The interactive path requires superuser (admin-level) authentication to FileRun and network access to the image_preview.php endpoint with a crafted args parameter. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) accurately captures the primary interactive exploit path - network-accessible, low complexity, gated behind superuser authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to FileRun 2026.3.0 or later, where the no-op redefinition of escapeshellcmd() in CLI.php is corrected and shell metacharacter escaping is properly restored. … Detailed patch versions, workarounds, and compensating controls in full report.