PHP Object Injection Vulnerability in FileRun by Akruto
CVE-2026-73699

8.6HIGH

Key Information:

Vendor

Filerun

Status
Filerun
Vendor
CVE Published:
10 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-73699?

FileRun versions before 2026.3.0 are susceptible to a PHP object injection flaw, which allows authenticated attackers to execute arbitrary code. This vulnerability arises from incorrect options being supplied to the unserialize() function within the Perms::getPerms() method. Instead of using the required named-key array, a positional array is utilized, leading to a situation where attackers, who have database write permissions, can craft a serialized payload. This payload can be injected into the permissions table, which is executed on each authenticated load of the page. Consequently, this could result in writing unauthorized files, such as web-accessible PHP webshells, thereby compromising the system's integrity.

Affected Version(s)

FileRun 0 < 2026.3.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-73699 - Proof of Concept

References

https://vulncheck.com/blog/filerun-delegated-admin-sql-to...
technical-descriptionexploit
https://filerun.com/index.php/changelog?v=2026.3.0
release-notespatch
https://www.vulncheck.com/advisories/filerun-php-object-i...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
VulnCheck
.