CVE-2026-63358: FileGator privilege escalation
Published Jul 21, 2026
·Updated
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
Affected Software
2 affected components
FileGator
filegator filegator<7.14.2
Remediation
Event History
Jul 21, 2026
CVE Published
via MITRE·08:13 PM
Data Sourced
via MITRE·08:13 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who is exposed to this issue?
Authenticated FileGator users who have the chmod permission are exposed. The attack vector is local, so exploitation requires access within the affected environment.
2
What level of access does an attacker need before exploiting this?
An attacker needs a valid authenticated account with permission to use chmod. No user interaction is required.
3
What should teams do if they identify an affected deployment?
Apply the available patch. The provided references include the upstream changelog entry and the remediation commit.