Loading story…
A critical OS command injection flaw tracked as CVE-2026-14863 allows remote code execution in FileRun through its thumbnail generation workflow. The vulnerability affects FileRun up to and including 2026.2.0 and stems from attacker-controlled filenames being passed to exec() inside shell double quotes without proper sanitization such as escapeshellarg(). By uploading a file with shell command substitution in its name, such as a payload using $(), an authenticated attacker can trigger command execution when FileRun invokes thumbnail tools including ffmpeg, ImageMagick, vips, or stl-thumb. The issue is classified as CWE-78 and carries a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
VulnCheck reported that exploitation is possible for any authenticated user with default upload permissions and, in some deployments, may also be reachable before authentication through public file-request weblinks if an attacker knows the token. The official FileRun Docker image reportedly enables the vulnerable thumbnail extractors by default, increasing exposure for containerized deployments. Successful exploitation can provide code execution as www-data, potentially exposing all files managed by FileRun, database credentials, and broader access to the host server. FileRun 2026.2.1 is listed as unaffected and contains the fix.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-13, VulnCheck publicly disclosed CVE-2026-14863, detailing how uploaded filenames containing shell metacharacters can trigger command execution during thumbnail generation. The disclosure also noted default exposure in official Docker deployments and described authenticated and file-request weblink exploitation paths.
CVE-2026-14863 was newly received by disclosure@vulncheck.com on August 11, 2026. The CVE describes an OS command injection vulnerability in FileRun's thumbnail generation workflow that can lead to remote code execution.
Vendor coordination started on 2026-07-06, and FileRun released version 2026.2.1 that day to fix CVE-2026-14863. The vulnerability affects FileRun up to and including version 2026.2.0, while 2026.2.1 is listed as unaffected.
VulnCheck discovered CVE-2026-14863 in FileRun on 2026-07-05 and reproduced both authenticated and pre-authentication remote code execution in a Docker lab the same day. The flaw stems from command injection in thumbnail generation via attacker-controlled filenames passed to exec().
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
chocapikk.com
Open sourcevulncheck.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical, **zero-click unauthenticated OS command injection** vulnerability was disclosed in the open-source video hosting/streaming platform **AVideo**, tracked as **CVE-2026-29058**. The flaw affects versions **prior to 7.0** (including **6.0**) and allows remote attackers to execute arbitrary operating system commands on the server without user interaction or prior privileges, creating a path to **full server compromise**, **data exfiltration** (e.g., configuration secrets, internal keys, credentials), and **service disruption**. The issue stems from `objects/getImage.php`, where attacker-controlled input in the `base64Url` GET parameter is Base64-decoded and incorporated into a double-quoted `ffmpeg` shell command without proper escaping/neutralization of shell metacharacters and command substitution (CWE-78). The vulnerability was reported by security researcher **Arkmarta**, and remediation is available by upgrading to **AVideo 7.0 or later**, which includes the official patch.
Jun 29, 2026
A critical path traversal flaw tracked as **`CVE-2026-56260`** allows unauthenticated remote attackers to write arbitrary files on servers running vulnerable versions of **Crawl4AI**. The issue affects the Docker API server’s **`/screenshot`** and **`/pdf`** endpoints, where the **`output_path`** parameter accepts absolute paths and directory traversal sequences without proper validation. The vulnerability impacts versions up to and including **`0.8.6`** and was fixed in **`0.8.7`**. By overwriting files writable by the application user, attackers could cause denial of service and compromise system integrity, including planting SSH authorized keys or injecting cron jobs for persistence. The flaw is classified as **`CWE-22`** and carries a **CVSS 9.1** rating with network-based, unauthenticated exploitation potential. Reports said no public proof-of-concept or confirmed active exploitation had emerged at publication time, and advised organizations to upgrade immediately or restrict access to the exposed endpoints as a compensating control.
Jul 13, 2026
WWBN **AVideo** versions up to and including `26.0` are affected by two high-severity flaws that can lead to **remote code execution**. `CVE-2026-33482` is an OS command injection bug in `sanitizeFFmpegCommand()`, which strips some shell metacharacters but fails to remove bash command substitution using `$()`. Because the resulting `ffmpeg` command is later executed in a double-quoted `sh -c` context by `execAsync()`, an attacker able to craft a valid encrypted payload can run arbitrary commands on the standalone encoder server. A separate issue, `CVE-2026-33507`, allows unauthenticated code execution through the plugin import workflow. The `objects/pluginImport.json.php` endpoint permits admin users to upload and install plugin ZIP archives containing executable PHP, but lacks **CSRF** protection; with `session.cookie_samesite = 'None'` on HTTPS connections, an attacker can trick a logged-in administrator into silently importing a malicious plugin and deploying a PHP webshell. Fixes were introduced in commits `25c8ab90269e3a01fb4cf205b40a373487f022e1` and `d1bc1695edd9ad4468a48cea0df6cd943a2635f3`.
Jun 29, 2026