FileRun installations that use a version before 2026.3.0 have a PHP object injection flaw caused by the Perms array to unserialize() instead of a named‑key array that is required to disable class instantiation. This mistake allows an authenticated attacker who can write to the database to inject a serialized gadget chain into the permissions table. On every authenticated page load the malicious payload is deserialized, giving the attacker the ability to write arbitrary files—such as PHP webshells—to any web‑accessible path and then execute them, resulting in full server compromise.

All FileRun deployments running a release older than 2026.3.0 are affected. The FileRun product contains the flaw, and versions 2026.3.0 and newer are not affected.

The vulnerability has a CVSS score of 8.6, indicating high severity. No EPSS data is available and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with database write privileges; such a user can mutate permission records to embed a gadget chain. Upon execution, the attacker can deposit and run code that gives complete control over the web server.