CVE-2026-63358
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes them directly to PHP's 'chmod()' function via 'octdec()' conversion without validation. An authenticated user with 'chmod' permission can escalate privileges to root.
Risk Assessment
An attacker can gain full control of the FileGator server, compromising confidentiality, integrity, and availability of data.
Recommendation
Update FileGator to a version that validates permission values. Restrict 'chmod' permission to trusted users only.
Other vulnerabilities in FileGator
See all- CVE-2026-94619Medium
FileGator prior to 7.15.0 uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage in POST /upload. A low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the handler reads a pre-existing temporary file with that name and stores it in the attacker's home directory. The same filename path can append data when chunks are supplied.
- CVE-2026-94618Medium
FileGator prior to 7.15.0 uses batchDownloadStart() in GET /batchdownload to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. A user with read, download, and batchdownload permissions who obtains another user's active archive id can retrieve the victim's batch archive. A successful replay also deletes the victim's pending archive.
Original NVD description (English source)
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS