FileRun up to and including version 2026.2.0 is vulnerable to operating‑system command injection that permits authenticated users to trigger remote code execution. The flaw arises during thumbnail generation when filenames supplied by the user are passed to exec() without proper escaping; a malicious filename containing shell substitution syntax such as $(PAYLOAD).mp4 is treated as a command by ffmpeg, ImageMagick, vips, or stl-thumb, thereby enabling arbitrary code execution on the host. This is a classic OS command injection (CWE‑78) that directly compromises confidentiality, integrity, and availability of the affected systems.

The affected product is FileRun FileRun and any deployment of that software running version 2026.2.0 or earlier. The vulnerability affects all installations that accept file uploads and generate thumbnails for those files. Upgrading to version 2026.2.1, which removes the unsafe exec() usage, eliminates the flaw.

The CVSS score of 8.7 indicates high severity, and an EPSS score of 2% suggests a moderate likelihood of exploitation at present, though the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated to perform a file upload, but once a malicious filename is processed the attacker gains arbitrary shell access. Given the high impact and relatively low but non‑negligible exploitation probability, the risk is considered significant for exposed systems.