CVE-2026-94619
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
FileGator prior to 7.15.0 uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage in POST /upload. A low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the handler reads a pre-existing temporary file with that name and stores it in the attacker's home directory. The same filename path can append data when chunks are supplied.
Risk Assessment
This can allow disclosure, modification, or deletion of another user's transient object, including a pending archive or the login rate-limit lockfile.
Recommendation
Upgrade FileGator to version 7.15.0 or later.
Other vulnerabilities in FileGator
See all- CVE-2026-94618Medium
FileGator prior to 7.15.0 uses batchDownloadStart() in GET /batchdownload to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. A user with read, download, and batchdownload permissions who obtains another user's active archive id can retrieve the victim's batch archive. A successful replay also deletes the victim's pending archive.
- CVE-2026-63358High
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes them directly to PHP's 'chmod()' function via 'octdec()' conversion without validation. An authenticated user with 'chmod' permission can escalate privileges to root.
Original NVD description (English source)
FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker's home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user's transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS