Advisories · Technology
FileRun.
Every CVE that names FileRun among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()
- FileRun
- Insecure deserialization
- CVSS 8.6 High
FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action
- FileRun
- SQL injection
- CVSS 8.6 High
FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
- FileRun
- Command injection
- CVSS 8.7 High
FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
- FileRun
- Command injection
- CVSS 8.7 High
FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection
- FileRun
- Command injection