the PhotoProofSheet handler can run commands
FileRun versions older than 2026.3.0 let an authenticated uploader run arbitrary commands on the server through a specially named uploaded file.
- Severity
- HighCVSS 3.1 · 8.8
- Fix
- Fixed in 2026.3.0
- Affected versions
- before 2026.3.0
- Weakness
- CWE-78OS Command Injection
- Exploit likelihood
- 1.8% in 30 daysEPSS, higher than 77% of known flaws
- Affects
- FileRun
- Exploited
- Not confirmedNo confirmation recorded
- CISA SSVC
- No known exploitationAutomatable: no · Technical impact: total
- EU ID
- EUVD-2026-75598ENISA vulnerability database
How it works
- An attacker needs a FileRun account with upload permission.
- They upload a file with shell instructions in its name, then trigger FileRun's photo proof-sheet feature.
- FileRun sends that filename through the server's command shell without safely separating it from the image-processing command.
- The command runs with the web server's permissions.
What to do
Check the installed FileRun release and compare it with the VulnCheck advisory. versions older than 2026.3.0 are in scope.
Update FileRun to 2026.3.0, the first build that closes this vulnerability, using the vendor's official release. Until updating, FileRun says hiding the photo proof-sheet plugin from the control panel can reduce exposure.
Technical details
CVE-2026-73693 is an authenticated OS command injection in FileRun's PhotoProofSheet handler. A filename reaches ImageMagick's montage command through a shell without adequate escaping, allowing commands to run as the web-server user. FileRun fixed this vulnerability in 2026.3.0.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required Low Attacker needs a basic user account
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculatorReferences
- filerun.com · changelog release-notes patch NVD
- vulncheck.com · filerun-delegated-admin-sql-to-object-injection-rce third party advisory technical description technical-description exploit NVD
- vulncheck.com · filerun-os-command-injection-via-photoproofsheet-handler third party advisory technical description third-party-advisory NVD
- cve.org · CVERecord vdb entry
- tenable.com · CVE-2026-73693 third party advisory vdb entry
- cvefeed.io · CVE-2026-73693 third party advisory vdb entry
- cveawg.mitre.org · CVE-2026-73693