FileRun versions before 2026.3.0 have an OS command injection vulnerability in the PhotoProofSheet handler. Authenticated users with upload permissions can exploit this by uploading files with shell metacharacters in their names. This leads to arbitrary command execution as the web-server user due to improper sanitization in the ImageMagick montage command construction.