Vulnerabilities & Exploits · Web App Attack

FileRun Thumbnails Turn Filenames Into Code

VulnCheck disclosed CVE-2026-14863 in FileRun, fixing it in version 2026.2.1 after finding that thumbnail generation in 2026.2.0 and earlier can run attacker-controlled code. The bug reaches any authenticated uploader, and a public file-request weblink can make it reachable without an account.

FileRun’s thumbnail extractors build a shell command from the uploaded filename and pass it to exec() without stripping shell syntax, so a name containing $() can execute when the server tries to preview the file. That means the preview step, not the upload itself, is the code-execution path.

If your FileRun deployment leaves previews on, the exposed surface is the thumbnail pipeline itself; the official Docker image enables that path by default, so a container can be vulnerable even when the upload feature looks ordinary.

1 source · Aug 13

Timeline

• Aug 13 Reported by VulnCheck

Sources

• Aug 13 VulnCheck

  FileRun: When Your File Manager Runs Your Files | Blog | VulnCheck

  VulnCheck's Initial Access Intelligence team details an OS command injection in FileRun's thumbnail generation, where the extractors pass user-controlled filenames to exec() without shell escaping, yielding remote code execution for any authenticated user or, through a public file-request weblink, without credentials.

  original

Part of the PlainSec briefing for 2026-08-13

Every edition of this story: FileRun Thumbnails Turn Filenames Into Code

More from today

• CISA’s KEV Update Spans Four Live Exploits
• Gunra Shifts Ransomware to Perimeter Break-ins
• SharePoint JWT Flaw Is Being Exploited