CVE-2026-73698— FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action
Quick assessment
Affected
FileRun FileRun
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 2026.3.0 之前，FileRun 存在一个 SQL 注入漏洞。该漏洞允许被委托的或普通管理员通过将 参数提交为数组，从而执行任意 SQL。具体而言， 中的 方法会将原始数组值直接插值到 语句中，而未进行参数化。 由于底层 PDO 连接使用的是模拟预编译语句（emulated prepared statements），支持堆叠查询（stacked queries），攻击者可以利用这一特性操纵 表，将一个被委托的管理员账户提升为超级用户权限。此外，攻击者还可能通过日志列表组件中未过滤的路径值（传入 ）实现任意
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73698
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action
Source: CVE Program / CVE List V5
Vulnerability Description
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to require_once in the logs listing component.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-73698
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73698
请登录查看更多情报信息。
Other References for CVE-2026-73698 (3)
-
-
https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce technical-description exploit
Same Patch Batch · FileRun · 2026-09-10 · 4 CVEs total
| CVE-2026-73693 | 8.8 HIGH | FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler |
| CVE-2026-73699 | 7.2 HIGH | FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms() |
| CVE-2026-73694 | 7.2 HIGH | FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition |
IV. Related Vulnerabilities
Same product: FileRun
-
CVE-2026-73699
FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms( -
CVE-2026-73694
FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() -
CVE-2026-73693
FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet -
CVE-2026-14863
FileRun 2026.2.0 RCE via Thumbnail Generation Command Inject
Same vendor: FileRun
-
CVE-2026-73699
FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms( -
CVE-2026-73694
FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() -
CVE-2026-73693
FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet -
CVE-2026-14863
FileRun 2026.2.0 RCE via Thumbnail Generation Command Inject
Same weakness: CWE-89
-
CVE-2026-81800
WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - -
CVE-2026-88890
OpenPanel SQL Injection via unvalidated profile filter colum -
CVE-2026-9163
SQLi in GIS Informatics' GisLab Laboratory Management System -
CVE-2026-78082
Joomla Extension - joomshaper.com - Unauthenticated SQL Inje -
CVE-2026-7188
SQLi in Armiya Information Technologies' Access Control Syst
V. Comments for CVE-2026-73698
No comments yet