FileRun: When Your File Manager Runs Your Files
OS Command Injection in FileRun's thumbnail generation - authenticated (CVSS v4 8.7) or via public 'file request' weblinks (CVSS v4 9.2). The extractors wrap file paths in double quotes and pass them to exec(), but the filename sanitizer allows $(){}` - enough for command substitution. The weblink path uploads a malicious filename via anonymous upload, then self-triggers thumbnail generation through the public listing.
>_
openDCIM: From SQL Injection to RCE via Config Poisoning
Three chained vulnerabilities in openDCIM turn a missing authorization check into unauthenticated remote code execution on Docker deployments.