The vulnerability is an OS command injection in FileRun’s PhotoProofSheet handler caused by a missing escapeshellarg() call when building an ImageMagick montage command. Because the command is executed by the web‑server user, an attacker who can upload a file with shell metacharacters in the name can inject arbitrary shell code – a classic CWE‑78 flaw that directly turns an input parameter into executable commands. The result is full remote execution of commands with the privileges of the web–application process.

All releases of the FileRun file‑management application older than version 2026.3.0 are affected. The flaw exists in the PhotoProofSheet feature that processes uploaded images. Users who have upload permission in FileRun can trigger the flaw by uploading a filename containing backticks, semicolons, or $() sequences and then invoking the PhotoProofSheet endpoint.

With a CVSS score of 8.7 the flaw is classified as high severity. The EPSS score is 2% and the vulnerability is not listed in CISA’s KEV catalog, but neither fact reduces the practicality of exploitation. The attack rights – a common configuration – and the ability to invoke the PhotoProofSheet allow execution of arbitrary commands as the web‑server user, leading to full system compromise.