FileRun versions prior to 2026.3.0 have a PHP object injection vulnerability in the Perms::getPerms() method. This flaw allows authenticated attackers with database write access to execute arbitrary code by injecting a serialized gadget chain into the permissions table. The vulnerability arises from incorrect options passed to unserialize(), enabling attackers to write arbitrary files such as PHP webshells to web-accessible locations.