VULNERABILITY INTELLIGENCE
CVE-2026-14863
CVSS score8.8 HIGH
EPSS probability2.54%
CISA KEVNot currently listed
Published2026-08-11
Last modified2026-09-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowing filenames such as $(PAYLOAD).mp4 to survive the filename sanitizer and be evaluated as shell commands when ffmpeg, ImageMagick, vips, or stl-thumb processes the file during thumbnail generation.
Weakness classification
- disclosure@vulncheck.com: CWE-78