CVE-2026-14863: FileRun RCE Vulnerability

CVE-2026-14863 Overview

CVE-2026-14863 is an operating system command injection vulnerability in FileRun versions up to and including 2026.2.0. Authenticated attackers can achieve remote code execution by uploading a file whose name contains shell command substitution sequences. FileRun's thumbnail generation pipeline passes filenames wrapped in shell double-quotes directly to exec() without calling escapeshellarg(). Filenames such as $(PAYLOAD).mp4 bypass the filename sanitizer and are evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file. The flaw is tracked as CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated users can execute arbitrary commands on the FileRun host by uploading a maliciously named file, enabling full server compromise.

Affected Products

FileRun versions up to and including 2026.2.0
FileRun deployments using thumbnail generation via ffmpeg, ImageMagick, vips, or stl-thumb
FileRun installations accepting authenticated file uploads

Discovery Timeline

2026-08-11 - CVE-2026-14863 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-14863

Vulnerability Analysis

FileRun generates thumbnails for uploaded media by invoking external binaries such as ffmpeg, ImageMagick, vips, and stl-thumb. The application constructs the shell command by wrapping the uploaded filename in double quotes and passing the resulting string to PHP's exec() function. Because double quotes in POSIX shells preserve command substitution semantics, any $(...) or backtick expression inside the filename is evaluated before the target binary runs. The filename sanitizer permits the characters required for command substitution, so a payload like $(id > /tmp/pwn).mp4 traverses the upload pipeline intact. When thumbnail generation triggers, the shell expands the substitution and executes the attacker-controlled command with the privileges of the web server user.

Root Cause

The root cause is the absence of escapeshellarg() or an equivalent argument-quoting routine around the filename before it enters exec(). Wrapping untrusted input in literal double quotes is not sufficient to neutralize shell metacharacters, because $, `, and \ retain their special meaning inside double-quoted strings. The upstream filename sanitizer also fails to strip or reject the substitution syntax.

Attack Vector

An authenticated attacker with upload permissions uploads a file whose name contains a shell command substitution payload and an extension that FileRun routes to a thumbnail generator, such as .mp4, .jpg, or .stl. When FileRun processes the file for preview rendering, the shell interprets the embedded substitution and executes the injected commands on the server. Exploitation requires low privileges and no user interaction beyond the initial upload. Refer to the VulnCheck FileRun RCE Advisory and the accompanying VulnCheck technical blog post for the full exploitation chain.

Detection Methods for CVE-2026-14863

Indicators of Compromise

Uploaded files whose names contain $(, `, or \ characters, particularly in combination with media extensions such as .mp4, .jpg, .png, or .stl
Unexpected child processes of the PHP-FPM or web server process spawning shells, curl, wget, or reverse-shell payloads
Outbound network connections from the FileRun host to unfamiliar destinations shortly after file upload events
New or modified files in web-writable directories that do not correspond to legitimate uploads

Detection Strategies

Alert on ffmpeg, convert, vips, or stl-thumb invocations whose command line contains shell substitution syntax
Monitor web server access logs for POST requests to FileRun upload endpoints followed by thumbnail generation errors
Correlate file-upload telemetry with process-execution telemetry to identify anomalous child processes tied to thumbnail workers

Monitoring Recommendations

Enable verbose PHP execution logging to capture the arguments passed to exec(), shell_exec(), and proc_open()
Baseline the expected process tree under the web server user and alert on deviations such as sh -c invocations
Retain file-upload metadata, including original filenames, for retrospective hunting across historical data

How to Mitigate CVE-2026-14863

Immediate Actions Required

Upgrade FileRun to version 2026.2.1 or later, which addresses the command injection in the thumbnail pipeline
Restrict upload permissions to trusted users while the patch is being deployed
Audit uploaded filenames for shell metacharacters and quarantine any suspicious files pending investigation
Rotate credentials and secrets accessible to the web server user if compromise is suspected

Patch Information

The vendor addressed the vulnerability in FileRun 2026.2.1. Deployment details are documented in the FileRun Changelog 2026.2.1. Administrators should verify the running version after upgrade and confirm that the thumbnail generation code paths now pass filenames through escapeshellarg() or an equivalent sanitizer.

Workarounds

Disable thumbnail generation for file types processed by ffmpeg, ImageMagick, vips, and stl-thumb until the patch is applied
Enforce a strict filename allowlist at the reverse proxy or web application firewall that rejects $, `, and \ characters
Run the PHP worker process under a low-privilege account with no shell access and constrained filesystem permissions
Isolate the FileRun host with egress filtering to limit post-exploitation impact

bash

# Example WAF rule concept to block substitution characters in uploaded filenames
# Reject multipart upload requests whose filename parameter contains shell metacharacters
SecRule FILES_NAMES "@rx [\$\`\\\\]" \
    "id:1014863,phase:2,deny,status:400,log,\
     msg:'CVE-2026-14863 - Shell metacharacter in uploaded filename'"