Filerun
Monthly
PHP object injection in FileRun before 2026.3.0 enables authenticated attackers with database write access to achieve remote code execution via a misconfigured unserialize() call in Perms::getPerms(). A positional array is passed instead of a named-key array to set allowed_classes, causing PHP to ignore the class instantiation restriction entirely; a serialized gadget chain injected into the permissions table is deserialized on every subsequent authenticated page load, allowing arbitrary file writes - including PHP webshells - to web-accessible paths. VulnCheck reported this flaw with a publicly available proof-of-concept; a vendor patch is available in version 2026.3.0, and no confirmed active exploitation appears in CISA KEV at time of analysis.
SQL injection in FileRun before 2026.3.0 allows delegated or simple administrators to escalate privileges to superuser and chain a path-injection primitive into server-side code execution. The flaw lives in the getValuesString() method of DB/DP.php, where submitting the description parameter as a PHP array causes raw array values to be interpolated directly into an INSERT statement; because FileRun's PDO connection runs in emulated-prepared-statement mode, stacked queries are enabled and the df_users_permissions table can be rewritten at will. A publicly available exploit published by VulnCheck documents both the privilege-escalation path and the secondary RCE vector via unsanitized path values passed to require_once in the logs listing component.
OS command injection in FileRun before 2026.3.0 enables a network-accessible superuser to execute arbitrary commands on the underlying server, exploiting a deliberate no-op redefinition of PHP's escapeshellcmd() in CLI.php that strips all shell metacharacter escaping before attacker-controlled input reaches exec(). Two distinct exploitation paths exist: an immediate interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, and a more dangerous persistent backdoor path where malicious payloads stored by an admin in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss execute automatically whenever any user triggers video thumbnail generation. Publicly available exploit code from VulnCheck confirms practical exploitability; vendor-released patch 2026.3.0 is available.
OS command injection in FileRun's PhotoProofSheet handler allows any authenticated user with upload permission to execute arbitrary commands as the web-server user by uploading files with shell metacharacters in their names. The root cause is a missing escapeshellarg() call when constructing the ImageMagick montage shell command, meaning backticks, semicolons, or $() sequences in filenames are evaluated by the shell. A public proof-of-concept has been released by VulnCheck; vendor-released patch is available in version 2026.3.0.
Remote code execution in FileRun ≤2026.2.0 is achievable by any authenticated user who can upload files, exploiting a shell command injection flaw in the thumbnail generation pipeline. The subsystem passes uploaded filenames wrapped in double-quotes directly to exec() without escapeshellarg() sanitization, meaning filenames such as $(PAYLOAD).mp4 survive the filename sanitizer and are evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the upload. Vendor-released patch 2026.2.1 is available; no CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity, authenticated-only barrier makes this a high-priority patch target for any FileRun deployment.
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman§ion=get&page=grid` leads to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman§ion=do&page=up URI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FileRun 2019.05.21 allows css/ext-ux Directory Listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FileRun 2019.05.21 allows images/extjs Directory Listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata§ion=cpanel&page=list_filetypes. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module (under the search. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PHP object injection in FileRun before 2026.3.0 enables authenticated attackers with database write access to achieve remote code execution via a misconfigured unserialize() call in Perms::getPerms(). A positional array is passed instead of a named-key array to set allowed_classes, causing PHP to ignore the class instantiation restriction entirely; a serialized gadget chain injected into the permissions table is deserialized on every subsequent authenticated page load, allowing arbitrary file writes - including PHP webshells - to web-accessible paths. VulnCheck reported this flaw with a publicly available proof-of-concept; a vendor patch is available in version 2026.3.0, and no confirmed active exploitation appears in CISA KEV at time of analysis.
SQL injection in FileRun before 2026.3.0 allows delegated or simple administrators to escalate privileges to superuser and chain a path-injection primitive into server-side code execution. The flaw lives in the getValuesString() method of DB/DP.php, where submitting the description parameter as a PHP array causes raw array values to be interpolated directly into an INSERT statement; because FileRun's PDO connection runs in emulated-prepared-statement mode, stacked queries are enabled and the df_users_permissions table can be rewritten at will. A publicly available exploit published by VulnCheck documents both the privilege-escalation path and the secondary RCE vector via unsanitized path values passed to require_once in the logs listing component.
OS command injection in FileRun before 2026.3.0 enables a network-accessible superuser to execute arbitrary commands on the underlying server, exploiting a deliberate no-op redefinition of PHP's escapeshellcmd() in CLI.php that strips all shell metacharacter escaping before attacker-controlled input reaches exec(). Two distinct exploitation paths exist: an immediate interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, and a more dangerous persistent backdoor path where malicious payloads stored by an admin in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss execute automatically whenever any user triggers video thumbnail generation. Publicly available exploit code from VulnCheck confirms practical exploitability; vendor-released patch 2026.3.0 is available.
OS command injection in FileRun's PhotoProofSheet handler allows any authenticated user with upload permission to execute arbitrary commands as the web-server user by uploading files with shell metacharacters in their names. The root cause is a missing escapeshellarg() call when constructing the ImageMagick montage shell command, meaning backticks, semicolons, or $() sequences in filenames are evaluated by the shell. A public proof-of-concept has been released by VulnCheck; vendor-released patch is available in version 2026.3.0.
Remote code execution in FileRun ≤2026.2.0 is achievable by any authenticated user who can upload files, exploiting a shell command injection flaw in the thumbnail generation pipeline. The subsystem passes uploaded filenames wrapped in double-quotes directly to exec() without escapeshellarg() sanitization, meaning filenames such as $(PAYLOAD).mp4 survive the filename sanitizer and are evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the upload. Vendor-released patch 2026.2.1 is available; no CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity, authenticated-only barrier makes this a high-priority patch target for any FileRun deployment.
A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman§ion=get&page=grid` leads to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman§ion=do&page=up URI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FileRun 2019.05.21 allows css/ext-ux Directory Listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FileRun 2019.05.21 allows images/extjs Directory Listing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata§ion=cpanel&page=list_filetypes. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users§ion=cpanel&page=list request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module (under the search. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.