Description
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statements enabling stacked queries, attackers can manipulate the df_users_permissions table to escalate a delegated administrator account to superuser privileges, and may additionally achieve code execution via unsanitized path values passed to require_once in the logs listing component.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
FileRun FileRun
Default version status: unaffected
0 to < 2026.3.0affected
References
- https://vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce ↗
- https://filerun.com/index.php/changelog?v=2026.3.0 ↗
- https://www.vulncheck.com/advisories/filerun-authenticated-sql-injection-via-groups-add-action ↗
- https://www.vulncheck.com/blog/filerun-delegated-admin-sql-to-object-injection-rce ↗