CVE-2026-73699

This is a flaw in how FileRun handles permission information. Someone with unusually powerful access can hide harmful instructions there, like placing a forged master key inside a staff-only filing system; when another authorized person opens a page, the server can run those instructions and create harmful files.

This matters to you if you run FileRun, especially if people, integrations, or administrative processes can change its database records. An attacker must already have a FileRun login and database-write capability; they do not need to trick anyone into clicking anything.

An attacker who has the required account and database access can take control of the server and place harmful files on it. Treat this as urgent because the impact is a full server compromise, although there are no confirmed reports of active exploitation and no public exploit code on record.

1. Confirm the deployed FileRun version and identify every FileRun server running a release earlier than 2026.3.0.
2. Upgrade each affected installation to FileRun 2026.3.0. No branch-specific fixed versions or upgrade-breaking changes were provided.
3. Before and after upgrading, review database access grants and the FileRun permissions data for unauthorized changes; investigate unexpected serialized-looking values or recent modifications.
4. Inspect web-accessible FileRun directories and server logs for newly created or unfamiliar PHP files, especially files created by the web-server account. Preserve suspicious files and logs for incident response rather than executing them.
5. If the upgrade must be delayed, remove unnecessary database-write privileges, restrict FileRun administrative access, and limit database access to trusted hosts until the upgrade is complete.
6. CISA has not added this CVE to KEV, so no CISA remediation due date is provided.

CVE-2026-73699 is rated CVSS 7.2 High (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). It is CWE-502 PHP object injection in Perms::getPerms(), caused by incorrect options passed to unserialize(); a positional array is used where a named-key array is required to prevent class instantiation. An authenticated attacker with database-write capability can inject a serialized gadget chain into permissions-table data processed during authenticated page loads, enabling arbitrary code execution and writes to web-accessible paths. CISA KEV does not list this CVE; no confirmed in-the-wild exploitation or public exploit code is recorded. EPSS is 0.5% (44th percentile) and flat.