CVE-2026-14863 - FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection
Brief
CVE ID : CVE-2026-14863
Published : Aug. 11, 2026, 8:41 p. m.
- 22 minutes ago
Description : FileRun up to and including version 2026.
- 0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences.
The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD). mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation.
Severity: 8.8
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...