OS Command Injection Vulnerability in FileRun by FileRun

CVE-2026-14863

What is CVE-2026-14863?

FileRun versions up to and including 2026.2.0 are vulnerable to an OS command injection issue. This vulnerability enables authenticated attackers to perform remote code execution by uploading files with specially crafted filenames. The system's thumbnail generation feature incorrectly passes these filenames to the exec() function without proper sanitization, allowing potential command substitution sequences to be executed. This flaw could lead to severe consequences if exploited, as malicious payloads embedded in filenames may execute shell commands during the processing of uploaded files.

References