CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()
Authenticated attackers with database write access can achieve arbitrary code execution via PHP object injection in FileRun permissions handling.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73699?
CVE-2026-73699 is a high-severity unsafe deserialization vulnerability in FileRun, published on 10 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into the permissions table columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths.
Weakness: CWE-502
Which versions are affected by CVE-2026-73699?
How do I fix CVE-2026-73699?
No fix has been published for CVE-2026-73699 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-73699 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73699 exists.
Sources
Also known as GHSA-3xv5-w7r3-9wj8.