CVE-2026-73694

FileRun versions before 2026.3.0 contain an OS command injection vulnerability rooted in a no-op redefinition of escapeshellcmd() in CLI.php , which strips shell-metacharacter escaping and allows attacker-controlled input to reach an exec() sink unsanitized. Two exploitation paths are identified:...