OS Command Injection in FileRun Thumbnail Generation

FileRun versions up to and including 2026.2.0 contain an OS command injection vulnerability located within the application's thumbnail generation system. The vulnerability exists because the application passes file names containing shell command substitution sequences directly to system-level execution functions without adequate sanitization or escaping via escapeshellarg().

An authenticated attacker can exploit this by uploading a specially crafted file with a malicious filename (e.g., using syntax like $(PAYLOAD).mp4). When the system attempts to generate a thumbnail for the uploaded file using back-end utilities such as ffmpeg, ImageMagick, vips, or stl-thumb, the shell interprets the embedded payload. This allows for remote code execution on the host server under the privileges of the web application user. This flaw is particularly significant for environments where file uploads are permitted for authenticated users.

Impact

Successful exploitation allows an authenticated attacker to achieve arbitrary remote code execution on the server. This can lead to full system compromise, data exfiltration, or lateral movement within the environment. All deployments of FileRun version 2026.2.0 and earlier are susceptible.

Recommendation

• Upgrade FileRun to the latest version as soon as a patch is available.
• Identify and audit user upload directories for files containing shell metacharacters or suspicious extensions.
• Monitor webserver logs for requests to thumbnail generation or upload endpoints that exhibit unusual query parameters or filename patterns.
• Deploy the Sigma rule below to detect attempts to exploit CVE-2026-14863 by identifying shell injection patterns in the process lineage of thumbnail generation utilities.