FileGator vulnerabilities

FileGator prior to 7.15.0 uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage in POST /upload. A low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the handler reads a pre-existing temporary file with that name and stores it in the attacker's home directory. The same filename path can append data when chunks are supplied.

FileGator prior to 7.15.0 uses batchDownloadStart() in GET /batchdownload to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. A user with read, download, and batchdownload permissions who obtains another user's active archive id can retrieve the victim's batch archive. A successful replay also deletes the victim's pending archive.

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes them directly to PHP's 'chmod()' function via 'octdec()' conversion without validation. An authenticated user with 'chmod' permission can escalate privileges to root.