A critical OS command injection vulnerability in FileRun allows authenticated users with upload access to achieve remote code execution on the underlying server.

The vulnerability exists in the PhotoProofSheet handler, which fails to properly sanitize filenames before passing them to the ImageMagick montage command. An authenticated attacker can upload a file with shell metacharacters in the name, triggering command execution as the web-server user when the contact sheet is generated.

This vulnerability carries a CVSS score of 8.8, indicating a high severity risk. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web-server user, potentially leading to full system compromise, unauthorized data access, and lateral movement within the network. The ability for a standard authenticated user to escalate to code execution represents a significant threat to organizational data integrity and system availability.

Immediate Action: Upgrade to FileRun version 2026.3.0 or later, which includes the necessary security fixes to sanitize input in the PhotoProofSheet handler.

Proactive Monitoring: Review web server access logs for requests to the PhotoProofSheet endpoint that contain unusual filename patterns or shell metacharacters such as backticks, semicolons, or dollar signs.

Compensating Controls: Implement strict file upload validation and restrict upload permissions to trusted users only, while utilizing a Web Application Firewall (WAF) to detect and block common shell injection patterns in HTTP requests.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the VulnCheck research write-up.

Given the high CVSS score and the existence of public technical details describing the exploit mechanism, administrators should prioritize the deployment of the 2026.3.0 update across all instances. Failure to patch leaves the environment vulnerable to remote code execution by any authenticated user with upload capabilities, posing a severe risk to the entire infrastructure.