CVE-2026-94618: FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileGatorto a version that resolves this vulnerability.Fixed in 7.15.0
Event History
Frequently Asked Questions
Which deployments are meaningfully exposed?
Deployments using distinct per-user home directories are exposed when users have read, download, and batchdownload permissions. The flaw can let one authorized user retrieve another user's active batch archive across those directory boundaries.
What does an attacker need to exploit this issue?
The attacker needs a valid user session with read, download, and batchdownload permissions, plus another user's active temporary archive identifier. The limited archive lifetime and requirement to obtain that identifier constrain exploitation.
Are affected archives impacted beyond unauthorized disclosure?
Yes. A successful replay deletes the victim's pending archive after it is retrieved.
What version fixes the issue?
The issue is fixed in version 7.15.0. Versions prior to 7.15.0 are affected according to the provided information.