Refine your search
3 vulnerabilities found for filegator by filegator
CVE-2026-94619 (GCVE-0-2026-94619)
Vulnerability from cvelistv5
Published
2026-11-06 21:32
Modified
2026-11-06 21:32
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker's home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user's transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "filegator",
"vendor": "filegator",
"versions": [
{
"status": "affected",
"version": "\u003c 7.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker\u0027s home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user\u0027s transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:32:00.424Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/filegator/filegator/security/advisories/GHSA-44r8-3p76-84mw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/filegator/filegator/security/advisories/GHSA-44r8-3p76-84mw"
},
{
"name": "https://github.com/filegator/filegator/pull/598",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filegator/filegator/pull/598"
},
{
"name": "https://github.com/filegator/filegator/commit/cae442a8323fddae7c8cee0924cdbb1aa6eea702",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filegator/filegator/commit/cae442a8323fddae7c8cee0924cdbb1aa6eea702"
},
{
"name": "https://github.com/filegator/filegator/releases/tag/v7.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filegator/filegator/releases/tag/v7.15.0"
}
],
"source": {
"advisory": "GHSA-44r8-3p76-84mw",
"discovery": "UNKNOWN"
},
"title": "FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-94619",
"datePublished": "2026-11-06T21:32:00.424Z",
"dateReserved": "2026-09-21T21:32:23.742Z",
"dateUpdated": "2026-11-06T21:32:00.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94618 (GCVE-0-2026-94618)
Vulnerability from cvelistv5
Published
2026-11-06 21:30
Modified
2026-11-06 21:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "filegator",
"vendor": "filegator",
"versions": [
{
"status": "affected",
"version": "\u003c 7.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user\u0027s active archive id can cross that boundary and retrieve the victim\u0027s batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim\u0027s pending archive. This issue is fixed in version 7.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:30:39.923Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/filegator/filegator/security/advisories/GHSA-f74m-x83r-c4v4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/filegator/filegator/security/advisories/GHSA-f74m-x83r-c4v4"
},
{
"name": "https://github.com/filegator/filegator/pull/597",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filegator/filegator/pull/597"
},
{
"name": "https://github.com/filegator/filegator/commit/638737e560cbf20cbeb5da4e4e6c974f8a080531",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filegator/filegator/commit/638737e560cbf20cbeb5da4e4e6c974f8a080531"
},
{
"name": "https://github.com/filegator/filegator/releases/tag/v7.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filegator/filegator/releases/tag/v7.15.0"
}
],
"source": {
"advisory": "GHSA-f74m-x83r-c4v4",
"discovery": "UNKNOWN"
},
"title": "FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user\u0027s archive"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-94618",
"datePublished": "2026-11-06T21:30:39.923Z",
"dateReserved": "2026-09-21T21:32:23.742Z",
"dateUpdated": "2026-11-06T21:30:39.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63358 (GCVE-0-2026-63358)
Vulnerability from cvelistv5
Published
2026-07-21 20:13
Modified
2026-07-30 17:30
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
8.4 (High) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
8.4 (High) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Summary
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63358",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T17:29:58.694887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T17:30:09.151Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "FileGator",
"vendor": "FileGator",
"versions": [
{
"lessThan": "7.14.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.14.2"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Abdul Moiz"
}
],
"datePublic": "2026-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FileGator accepts arbitrary Unix permission values via the \u0027/chmoditems\u0027 API endpoint and passes the value directly to PHP\u0027s native \u0027chmod()\u0027 function through \u0027octdec()\u0027 conversion, with no validation. This allows an authenticated user with \u0027chmod\u0027 permission to upgrade their privileges to root."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63358",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T19:33:24.593024Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T20:13:07.624Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"release-notes"
],
"url": "https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18"
},
{
"name": "url",
"tags": [
"patch"
],
"url": "https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c"
},
{
"name": "url",
"tags": [
"product"
],
"url": "https://github.com/filegator/filegator/tree/master"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63358"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json"
}
],
"title": "FileGator privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-63358",
"datePublished": "2026-07-21T20:13:07.624Z",
"dateReserved": "2026-07-16T14:46:57.734Z",
"dateUpdated": "2026-07-30T17:30:09.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}