FileRun OS Command Injection Vulnerability (CWE-78) Fix Bulletin

Vulnerability Overview Vulnerability Name: CWE-78 (OS Command Injection) CVSS Score: 3.1: 8.8 High Release Date: July 23, 2026 Impact Scope This vulnerability involves OS command injection, which may allow attackers to execute arbitrary operations by injecting malicious commands. Remediation This security vulnerability has been fixed in FileRun Update 2026.2.1. POC Code or Exploit Code No specific POC code or exploit code is provided on the page. Other Updates July 5, 2026 Update: - Added dashboard tools for bulk role assignment. - Fixed protocol incompatibility issues with Nextcloud OCS V1 API endpoint requests. - Added the "Open Locally" file handler, allowing files or folders on the local machine to be opened from the browser. - Added the Euro-Office plugin for creating/editing Office files. - Updated language support for Office editors (ONLYOFFICE, Collabora, Euro-Office, Microsoft 365, and LibreOffice Online). - Fixed an issue where directories could be downloaded directly via shared links. - Fixed a PHP error that occurred when attempting to send login information while creating a new user account from the dashboard. May 21, 2026 Update: - Fixed redirection issues after SSO authentication. - Fixed compatibility issues with iOS Nextcloud. - Fixed the accent color issue in iOS Nextcloud. - Fixed audio file autoplay issues when the "Disable autoplay of the next file" option is enabled. - Increased file upload timeout to prevent transfers from hanging when the server returns an error. - Added a dashboard option to create a complete database export file. - Fixed an issue where the "Extract Archive" option no longer displayed unsupported file types. May 9, 2026 Update: - Improved file/folder sharing functionality in Nextcloud apps (iOS, Android, Windows). - Added support for WebDAV COPY. - Added support for WebDAV COPY/MOVE overwrite. - Fixed issues with extracting files/folders whose names start with a dot or space character. - Fixed issues with copying files/folders whose names start with a dot or space character. - Modified the behavior of the "Hide Hidden Files" setting. - Fixed login entry logging for WebDAV requests. - Fixed issues with extracting files/folders whose names start or end with a space character. - Fixed the auto-scrolling issue of the breadcrumb bar on mobile devices. - Fixed an issue when adding roles with the "Users can read comments" option. - Fixed the missing attribute in PROPFIND allprop requests. - Fixed an error when attempting to generate application credentials for accounts without stored passwords. - Fixed an issue where the permission field "Users can access file activity log" was displayed incorrectly when editing user accounts. - Added a dashboard option to set the size of "Small" files for optimizing file uploads. - Fixed an error when attempting a fresh installation of FileRun 2026.2.0 while updating an existing database.

Goal Reached Thanks to every supporter — we hit 100%!

FileRun OS Command Injection Vulnerability (CWE-78) Fix Bulletin