---
id: "CVE-2026-94618"
page: "https://infrastack.ai/live/CVE-2026-94618"
kind: "vulnerability"
aliases: ["CVE-2026-94618"]
title: "FileGator: batch download lets a user fetch another user's archive"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["filegator", "package", "php", "self-hosted"]
not_affected_if: ["batchdownload-disabled", "fixed-7.15.0", "no-per-user-home-dirs", "single-user"]
published_at: "2026-11-06T22:18:00+00:00"
first_seen_at: "2026-11-06T22:44:33+00:00"
updated_at: "2026-11-06T22:44:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94618", "first_seen_at": "2026-11-06T22:44:33+00:00"}]
exploit_sources: []
---

# FileGator: batch download lets a user fetch another user's archive

Link for people: https://infrastack.ai/live/CVE-2026-94618 (this .md is for agents)

FileGator, a multi-user file manager, does not check that the session requesting a batch download archive created it. A logged-in user who learns another user's active archive id can download that archive and delete it before the victim gets it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FileGator version; affected if below `7.15.0`.
- Look for multiple users with separate home directories and the batchdownload permission enabled.

## Fix

- Move to FileGator `7.15.0` or later.

## Timeline

- 2026-11-06T22:44:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94618

## Documents

- [advisory] Vendor advisory: github.com https://github.com/filegator/filegator/security/advisories/GHSA-f74m-x83r-c4v4
- [fix] Patch: github.com https://github.com/filegator/filegator/commit/638737e560cbf20cbeb5da4e4e6c974f8a080531
- [fix] Release notes: github.com https://github.com/filegator/filegator/releases/tag/v7.15.0

## From the sources

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_