CVE-2026-63358
HIGH SEVERITYCVSS Score & Metrics
Base Score
7.3 / 10
Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Vulnerability Description
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-732
Source
NVD
Vendor
FileGator
Product
FileGator
External References
- https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18
- https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c
- https://github.com/filegator/filegator/tree/master
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json
- https://www.cve.org/CVERecord?id=CVE-2026-63358
Discussion (0)
Add Comment
No comments yet. Be the first!