CVE-2026-73694

HighCVSS 7.2/10Last modified Sep 11, 2026

Description

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2026
Last modified
Sep 11, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-736987.2FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by suCVE-2026-736997.2FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploCVE-2026-737009.0A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator CVE-2026-737019.0An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and couldCVE-2026-737028.8A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticatCVE-2026-737038.8A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to CVE-2026-737048.8A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low CVE-2026-737058.8An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user CVE-2026-737068.6A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system informaCVE-2026-737078.5Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticateCVE-2026-737088.3A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated lowCVE-2026-737098.3A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run
CVE-2026-73694: High severity, CVSS 7.2 | Vulnix