CyberRota Analysis
AI-GeneratedFileRun versions prior to 2026.3.0 are vulnerable to a PHP object injection flaw that enables authenticated attackers to execute arbitrary code by manipulating options in the Perms::getPerms() method. This vulnerability allows attackers with database write access to inject serialized data into the permissions table, potentially leading to the deployment of web shells or other malicious files in accessible directories. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized code execution and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into the permissions table columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths.