CyberRota Analysis
AI-GeneratedFileRun versions prior to 2026.3.0 are vulnerable to an OS command injection due to improper handling of shell command escaping in the CLI.php file. This flaw allows attackers to execute arbitrary commands by injecting malicious input through specific parameters, potentially leading to unauthorized access or system compromise. Organizations using affected versions should prioritize patching this vulnerability, especially those with superuser access or functionality related to video thumbnail generation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation.