Executive brief
FileRun is a self-hosted file manager and sharing platform. The PhotoProofSheet feature, which creates thumbnail contact sheets for images, fails to sanitize filenames before passing them to the shell for image processing. An authenticated user with upload permissions can craft a malicious filename containing shell commands (like backticks or $() sequences) to execute arbitrary system commands as the web server user, potentially gaining full control of the server.
Technical details
CVE-2026-73693 is an OS command injection vulnerability (CWE-78) in FileRun's PhotoProofSheet handler, which constructs an ImageMagick montage command by wrapping filenames in double quotes and passing the resulting string to the shell. Double quotes do not prevent shell command substitution, allowing an attacker to inject commands via $(...) syntax or other shell metacharacters in the filename. The vulnerability requires authentication with upload permission; the attacker uploads a weaponized image file with command syntax in its name and then triggers the PhotoProofSheet endpoint to process it. The root cause is the absence of proper escaping (escapeshellarg()) around the filename parameters. FileRun 2026.3.0, released September 6, 2026, patches this vulnerability.
Affected products
- FileRun FileRun before 2026.3.0
Timeline
- 2026-09-10: disclosed
- 2026-09-06: patched: FileRun 2026.3.0