Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-73693FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler

High 8.8

In plain English

A high-severity OS command injection in FileRun from FileRun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)2.7%top 14.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command substitution syntax such as backticks, semicolons, or $() sequences in the filename, then trigger the PhotoProofSheet endpoint to execute arbitrary commands as the web-server user due to missing escapeshellarg() sanitization in the ImageMagick montage command construction.

Affected products (as reported)

Vendor	Product	Versions
FileRun	FileRun	0 – before 2026.3.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

VulnCheck Blog technical-description, exploit
Release Notes release-notes, patch
https://www.vulncheck.com/advisories/filerun-os-command-injection-via-photoproofsheet-handler third-party-advisory