CVE-2026-94618 · Package
NO FIX YET · SEE WHAT TO DO
FileGator, a multi-user file manager, does not check that the session requesting a batch download archive created it. A logged-in user who learns another user's active archive id can download that archive and delete it before the victim gets it.
first public Aug 13, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of FileGator before 7.15.0 that give different users separate home directories and grant read, download and batchdownload permissions. An attacker needs a valid account and must obtain another user's active archive id, which limits exploitation. Single-user installs and installs without per-user home directories are not affected by the cross-user boundary.
Not affected if batchdownload-disabled, fixed-7.15.0, no-per-user-home-dirs, single-user
Who cares filegator, php, self-hosted
7.15.0.7.15.0 or later.FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.