Description (CNA)
FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD).mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| FileRun / FileRun | affected 0 through 2026.2.0; unaffected 2026.2.1 |
CWE
CWE-78
References
- https://filerun.com/
- https://filerun.com/index.php/changelog?v=2026.2.1
- https://www.vulncheck.com/advisories/filerun-rce-via-thumbnail-generation-command-injection
- https://www.vulncheck.com/blog/filerun-thumbnail-command-injection-rce
ADP enrichment
No English description supplied.
No references supplied.