FileRun versions prior to 2026.3.0 contain an OS command injection vulnerability due to a flawed redefinition of escapeshellcmd() in CLI.php that removes shell-metacharacter escaping. This allows attacker-controlled input to reach an exec() function without proper sanitization. Exploitation requires superuser authentication and can occur interactively via image_preview.php with a crafted args parameter or persistently by storing malicious payloads in specific thumbnail generation settings, which execute when video thumbnails are generated.