FileRun versions before 2026.3.0 have a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL commands. This occurs when the description parameter is submitted as an array, leading to unsafe interpolation in an SQL INSERT statement. Exploitation can escalate delegated administrator privileges to superuser and may enable code execution through unsanitized path values in the logs listing component.