CVE-2026-73693

This is a flaw in a feature that prepares photo proof sheets. A malicious filename can make the server follow an attacker’s instructions, like a delivery label that tricks a warehouse worker into handing over the building keys.

This matters if you run FileRun, especially where staff, customers, or partners can upload files. It is only a risk when an attacker already has a login with permission to upload files.

An attacker with an upload-capable FileRun account can run commands on the server, which can lead to complete system control. There is no confirmed public exploitation or public exploit code, but the potential impact warrants the RED priority.

Confirm the installed FileRun release and identify accounts or integrations with upload permission. Upgrade to FileRun 2026.3.0; the findings identify this as the fixed release and do not provide branch-specific alternatives or upgrade-breaking-change information. If patching is delayed, restrict upload permission to trusted accounts and limit access to the PhotoProofSheet feature. Review web-server and application logs for unusual PhotoProofSheet requests, suspicious filenames containing shell metacharacters, and unexpected processes or files created by the web-server user. This CVE is not listed in CISA KEV, so no CISA remediation due date is provided.

CVSS 8.8 (High): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-78 OS command injection is reachable over the network after authentication by a user with upload permission; a crafted filename is processed by the PhotoProofSheet handler. No public exploit code or confirmed in-the-wild exploitation is recorded, and CISA KEV does not list this CVE. EPSS is 1.8% (77th percentile) with a flat trend.