Executive brief
FileRun is a self-hosted file synchronization and sharing platform. A SQL injection vulnerability in the delegated administrator control panel allows non-superuser admin accounts to execute arbitrary SQL commands and escalate their privileges to superuser. When combined with a separate deserialization flaw, attackers can achieve remote code execution on the underlying server.
Technical details
CVE-2026-73698 is a SQL injection (CWE-89) vulnerability in FileRun's administrative interface affecting versions before 2026.3.0. The vulnerability exists in the DB/DP.php getValuesString() method, which fails to properly parameterize the description parameter when processing administrator records. When a delegated administrator submits the description as an array, raw array values are interpolated directly into an INSERT statement without parameterization. The underlying PDO connection uses emulated prepared statements with stacked queries enabled, allowing attackers to inject arbitrary SQL. This permits manipulation of the df_users_permissions table to escalate a delegated administrator account to superuser privileges. Chaining with CVE-2026-73699 (object deserialization), attackers can achieve code execution via unsanitized path values in the logs listing component. The vulnerability requires delegated/simple administrator privileges and is fixed in FileRun 2026.3.0 released September 6, 2026.
Affected products
- FileRun FileRun before 2026.3.0
Timeline
- 2026-09-10: disclosed
- 2026-09-06: patched: Fixed in FileRun 2026.3.0