FileRun is vulnerable to OS command injection, which allows an authenticated attacker to execute arbitrary system commands and gain unauthorized control over the server.

This vulnerability is a CWE-78 OS command injection flaw occurring during the thumbnail generation process. While the attack requires the attacker to be authenticated (PR:L), the ability to execute system commands results in a high-severity impact on the confidentiality, integrity, and availability of the host server.

A successful exploit grants the attacker the ability to run commands with the privileges of the web application service. This could lead to a full server compromise, data exfiltration, or the installation of persistent malicious backdoors. The CVSS score of 8.8 reflects the high risk posed to the server infrastructure.

Immediate Action: Upgrade your FileRun installation to version 2026.2.1 or later to resolve the command injection flaw.

Proactive Monitoring: Audit server logs for suspicious command execution patterns or unauthorized file access attempts originating from the web application user account.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block command injection attempts, and ensure the FileRun application runs with the least privilege necessary on the host operating system.

Public Exploit Available: No (exploit_available: false)

The severity of this command injection vulnerability necessitates an immediate update to version 2026.2.1. System administrators should verify the integrity of their environments following the update to ensure no unauthorized persistence mechanisms were established prior to patching.