VulnCheck disclosed CVE-2026-14863 in FileRun, fixing it in version 2026.2.1 after finding that thumbnail generation in 2026.2.0 and earlier can run attacker-controlled code. The bug reaches any authenticated uploader, and a public file-request weblink can make it reachable without an account.
FileRun’s thumbnail extractors build a shell command from the uploaded filename and pass it to exec() without stripping shell syntax, so a name containing $() can execute when the server tries to preview the file. That means the preview step, not the upload itself, is the code-execution path.
If your FileRun deployment leaves previews on, the exposed surface is the thumbnail pipeline itself; the official Docker image enables that path by default, so a container can be vulnerable even when the upload feature looks ordinary.