CVE-2026-73694

This is a flaw that can allow a FileRun user to send harmful instructions to the computer running the service. It is like a staff key that can be altered to unlock the building’s control room, not just the files the staff member should access.

This matters to you if your business runs FileRun before 2026.3.0. A superuser can trigger the issue directly, while a lower-privileged user can plant harmful thumbnail settings that run when someone views a video thumbnail; FileRun is reachable by default.

An attacker who obtains or already has a FileRun account can use this flaw to take control of the server, which makes this a red-priority issue. There is no confirmed public report of active exploitation or public exploit code, but the affected service is network-accessible by default and the impact is severe.

Confirm the installed FileRun version and identify all FileRun instances exposed to users or the internet. Upgrade each affected instance to FileRun 2026.3.0; the available patch information identifies this as the fixed release, with no branch-specific alternative provided.

Before and after upgrading, review superuser and lower-privileged accounts, especially recently created accounts or unexpected permission changes. Inspect thumbnails_ffmpeg_args and thumbnails_ffmpeg_ss for unfamiliar values, and review server process and web-server logs for unexpected command execution or thumbnail-generation activity.

If an upgrade must be delayed, restrict FileRun access to trusted administrators and temporarily disable or tightly control video thumbnail generation and its custom settings. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies. Monitor for suspicious account activity, altered thumbnail settings, and unusual server processes until the upgrade is complete.

CVE-2026-73694 is rated CVSS 7.2 (High): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. It is CWE-78 OS command injection: a no-op redefinition of escapeshellcmd() permits attacker-controlled input to reach an exec() sink without normal shell-metacharacter escaping. The direct image_preview.php path uses a crafted args parameter and requires superuser authentication; a persistent path stores payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss, executing when video thumbnail generation is triggered. EPSS is 1.8% (77th percentile) with a flat trend. The CVE is not in CISA KEV, there is no clear dated report of exploitation in the wild, and no public exploit code is on record.