Is CVE-2026-73698 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73698 being exploited in the wild.

How severe is CVE-2026-73698?

High severity, with a CVSS score of 7.2, published 10 September 2026.

Is there a fix for CVE-2026-73698?

A patch was published on 2026-09-06: Fixed in FileRun 2026.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73698 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73698?

Check whether you run FileRun at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73698: FileRun SQL injection in admin description field

CVE-2026-73698 · Severity: high · CVSS 7.2 · Published 2026-09-10

FileRun is a self-hosted file synchronization and sharing platform. A SQL injection vulnerability in the delegated administrator control panel allows non-superuser admin accounts to execute arbitrary SQL commands and escalate their privileges to superuser. When combined with a separate deserialization flaw, attackers can achieve remote code execution on the underlying server.

Technologies: FileRun. Vendors: FileRun.

Quick answers

Is CVE-2026-73698 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73698 being exploited in the wild.
How severe is CVE-2026-73698?: High severity, with a CVSS score of 7.2, published 10 September 2026.
Which products and versions are affected?: FileRun before 2026.3.0.
Is there a fix for CVE-2026-73698?: A patch was published on 2026-09-06: Fixed in FileRun 2026.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73698 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73698?: Check whether you run FileRun at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-73698 is a SQL injection (CWE-89) vulnerability in FileRun's administrative interface affecting versions before 2026.3.0. The vulnerability exists in the DB/DP.php getValuesString() method, which fails to properly parameterize the description parameter when processing administrator records. When a delegated administrator submits the description as an array, raw array values are interpolated directly into an INSERT statement without parameterization. The underlying PDO connection uses emulated prepared statements with stacked queries enabled, allowing attackers to inject arbitrary SQL. This permits manipulation of the df_users_permissions table to escalate a delegated administrator account to superuser privileges. Chaining with CVE-2026-73699 (object deserialization), attackers can achieve code execution via unsanitized path values in the logs listing component. The vulnerability requires delegated/simple administrator privileges and is fixed in FileRun 2026.3.0 released September 6, 2026.

Affected products

FileRun FileRun before 2026.3.0

Timeline

2026-09-10: disclosed
2026-09-06: patched: Fixed in FileRun 2026.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.