OS Command Injection in FileRun

FileRun versions prior to 2026.3.0 are susceptible to OS command injection due to the insecure redefinition of the PHP function 'escapeshellcmd()' within the 'CLI.php' file. This flaw effectively disables necessary character escaping for shell metacharacters, permitting unsanitized user input to reach an 'exec()' sink. The vulnerability presents two primary attack vectors: an interactive path requiring superuser privileges via 'image_preview.php' using the 'args' parameter, and a persistent vector where malicious payloads are injected into 'thumbnails_ffmpeg_args' or 'thumbnails_ffmpeg_ss'. In the latter scenario, the attacker-controlled code is executed whenever a user triggers the video thumbnail generation process, potentially leading to unauthorized system access or remote code execution.

Impact

Successful exploitation allows for remote code execution on the server hosting the FileRun instance. Depending on the privileges of the web service account, this could lead to full system compromise, exfiltration of stored user data, or lateral movement within the environment.

Recommendation

Update FileRun to version 2026.3.0 or later immediately to patch the command injection vulnerability in CLI.php.

Impact

The vulnerability is rated with a CVSS v3.1 base score of 7.2. Organizations utilizing FileRun are at risk of remote code execution, which could result in unauthorized data access or full server takeover.