Executive brief
FileRun is a self-hosted file management and sharing platform. A PHP object injection flaw in the permissions system allows authenticated attackers with database write access to execute arbitrary code by injecting malicious serialized objects. When combined with a separate SQL injection vulnerability, attackers can escalate from delegated administrator privileges to full remote code execution.
Technical details
CVE-2026-73699 is a PHP object injection (deserialization) vulnerability in the Perms::getPerms() method caused by improper use of unserialize(). The vulnerability occurs because the code passes a positional array instead of a named-key array to disable class instantiation, allowing attackers to instantiate arbitrary classes. While this vulnerability requires initial database write access, it is weaponized by CVE-2026-73698 (a SQL injection affecting delegated administrators) to write arbitrary files to web-accessible paths. The payload executes on every authenticated page load, making it a reliable exploitation vector. FileRun 2026.3.0 (released September 6, 2026) patches this vulnerability; prior versions including 2026.2.0 and 2026.2.1 are affected.
Affected products
- FileRun FileRun before 2026.3.0
Timeline
- 2026-09-10: disclosed
- 2026-09-06: patched: Fixed in FileRun 2026.3.0