The vulnerability in FileRun (CVE-2026-14863) is an OS command injection flaw present in versions up to and including 2026.2.0. Authenticated attackers can upload files with malicious filenames containing shell command substitution sequences (e.g., $(PAYLOAD).mp4). The thumbnail generation system wraps filenames in shell double-quotes but does not apply escapeshellarg() sanitization, allowing these sequences to be evaluated as shell commands when processed by external tools like ffmpeg, ImageMagick, vips, or stl-thumb. This leads to remote code execution with high impact on confidentiality, integrity, and availability.

Successful exploitation allows authenticated attackers to execute arbitrary operating system commands remotely, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system. The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on all security properties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions to trusted users only and consider disabling thumbnail generation or sanitizing filenames manually before processing. Monitor vendor channels for official patches or updates addressing this vulnerability.