FileRun applications prior to version 2026.3.0 are vulnerable to an OS command injection flaw. A no‑op redefinition of the PHP function escapeshellcmd() in CLI.php removes necessary escaping from user‑controlled data, allowing malicious input to reach an exec() sink without sanitization. Attackers can supply crafted arguments that are executed as shell commands, enabling arbitrary code execution on the host system.

Vulnerable systems include all installations of FileRun running any version earlier than 2026.3.0. The vulnerability is present in the file image_preview.php for interactive exploitation and in the thumbnails_ffmpeg_args and thumbnails_ffmpeg_ss configuration parameters for persistent exploitation when video thumbnails are generated.

This flaw carries a CVSS score of 8.6, indicating high severity and the potential for remote code execution. Although no EPSS value is available, the nature of the vulnerability—bypassing shell‑special‑character escaping—suggests a high likelihood of exploitation, especially by users who can attain superuser privileges or who can trigger thumbnail generation. The vulnerability is not listed in the CISA KEV catalog, but the absence of a publicly disclosed exploit does not reduce the risk for systems exposed to the web or with administrative privileges. Attackers could compromise the underlying operating system and any services running under the same user account, affecting confidentiality, integrity, and availability.