Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0271 85.5 —
AFFECTED Product Versions Fixed FileRun unspecified —
TIMELINE Aug 13 Reserved by VulnCheck Sep 10 Published (CNA: VulnCheck) Oct 1 EXPLOIT PUBLISHED — CVE-2026-73693 (FileRun). Public exploit reference added.
FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command substitution syntax such as backticks, semicolons, or $() sequences in the filename, then trigger the PhotoProofSheet endpoint to execute arbitrary commands as the web-server user due to missing escapeshellarg() sanitization in the ImageMagick montage command construction.
| Date | Event | Detail |
|---|---|---|
| August 13, 2026 | Reserved | Reserved by VulnCheck |
| September 10, 2026 | Published | Published (CNA: VulnCheck) |
| October 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-73693 (FileRun). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| FileRun | FileRun | — | — | — |
Authoritative record: CVE-2026-73693 at cve.org
Vendors: filerun
Weaknesses: CWE-78
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-73693 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
