Description

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD).mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T21:17:25.867Z",
  "pubdate": "2026-08-11T21:17:25.867Z",
  "executiveSummary": "FileRun up to and including version 2026.2.0 is affected by an OS command injection vulnerability.\nThe vulnerability resides in the thumbnail generation system, which improperly handles filenames during media processing.\nAuthenticated attackers can achieve remote code execution by uploading a specially crafted file containing shell command substitution sequences.\nThe flaw allows malicious input to bypass the filename sanitizer and be evaluated directly as shell commands.\nExploitation requires authentication and successful file upload capabilities to target internal processing utilities.",
  "technicalDetails": "The root cause of the vulnerability is the lack of proper input sanitization and argument escaping in the thumbnail generation system.\nSpecifically, the application passes filenames wrapped in shell double-quotes directly to the exec() function without applying escapeshellarg() sanitization.\nThe vulnerable component handles media processing tasks using external command-line utilities such as ffmpeg, ImageMagick, vips, and stl-thumb.\nAn authenticated attacker can exploit this behavior by uploading a file with a malicious filename containing shell command substitution sequences, such as $(PAYLOAD).mp4.\nBecause the filename sanitizer fails to neutralize command substitution syntax, the crafted string survives sanitization and is concatenated directly into the shell execution string.\nWhen the thumbnail generation process invokes the underlying system commands to process the uploaded file, the operating system shell evaluates the embedded command substitution sequences.\nThis execution flow results in arbitrary OS command injection with the privileges of the web application or service user.\nAffected software includes FileRun up to and including version 2026.2.0, requiring valid credentials and the ability to upload files to initiate the attack flow."
}