CVE-2026-94618
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
FileGator prior to 7.15.0 uses batchDownloadStart() in GET /batchdownload to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. A user with read, download, and batchdownload permissions who obtains another user's active archive id can retrieve the victim's batch archive. A successful replay also deletes the victim's pending archive.
Risk Assessment
This can lead to disclosure of another user's archive contents and deletion of their pending archive.
Recommendation
Upgrade FileGator to version 7.15.0 or later.
Other vulnerabilities in FileGator
See all- CVE-2026-94619Medium
FileGator prior to 7.15.0 uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage in POST /upload. A low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the handler reads a pre-existing temporary file with that name and stores it in the attacker's home directory. The same filename path can append data when chunks are supplied.
- CVE-2026-63358High
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes them directly to PHP's 'chmod()' function via 'octdec()' conversion without validation. An authenticated user with 'chmod' permission can escalate privileges to root.
Original NVD description (English source)
FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS