CVE-2026-94619: FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files
FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker's home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user's transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileGatorto a version that resolves this vulnerability.Fixed in 7.15.0
Event History
Frequently Asked Questions
Which deployments are exposed to cross-user impact?
The issue affects multi-user FileGator deployments that use distinct per-user home directories and versions before 7.15.0. The vulnerable temporary-file key is shared and unnamespaced, so one user's upload request can target another user's transient object.
What access does an attacker need?
An attacker needs a low-privileged FileGator account with upload permission. They can control the request-supplied resumableFilename and set resumableTotalChunks and resumableTotalSize to zero to trigger reads and deletion of an existing temporary file.
What temporary files could be affected?
Affected objects include other users' transient files, such as pending archives, and potentially the login rate-limit lockfile. Supplying chunks under the same filename can also append data, enabling modification in addition to disclosure or deletion.
What is the available fix?
Upgrade FileGator to version 7.15.0, which fixes the issue. The described sanitization restricts the primitive to the temporary directory, but it does not prevent impact to files stored there.