{"id":"CVE-2026-94619","kind":"vulnerability","aliases":["CVE-2026-94619"],"related":[],"title":"FileGator: upload handler lets a low-privileged user touch other users' temp files","description":"FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker's home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user's transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0.","summary":"FileGator, a multi-user file manager, uses a request-supplied filename as a key in shared temporary storage during uploads. A low-privileged user with upload permission can read, modify, or delete another user's pending temporary file, such as a pending archive.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["filegator","package","php","self-hosted"],"not_affected_if":["single-user","version-7.15.0-or-later"],"how_to_check":"- Check the FileGator version in use; affected if it is below `7.15.0`.\n- Look for a multi-user deployment with distinct per-user home directories, since the flaw needs that configuration.","fix":"- Move to FileGator `7.15.0` or later.","status":"open","published_at":"2026-11-06T22:18:00+00:00","first_seen_at":"2026-11-06T22:44:33+00:00","triaged_at":"2026-11-06T22:44:46+00:00","updated_at":"2026-11-06T22:44:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T22:44:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move to FileGator `7.15.0` or later.","reach":"network","title":"FileGator: upload handler lets a low-privileged user touch other users' temp files","impact":"medium","summary":"FileGator, a multi-user file manager, uses a request-supplied filename as a key in shared temporary storage during uploads. A low-privileged user with upload permission can read, modify, or delete another user's pending temporary file, such as a pending archive.","audience":"businesses","category":"package","nicknames":[],"who_cares":["filegator","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Another user's temporary files are read, altered, or deleted","analyst_note":"","how_to_check":"- Check the FileGator version in use; affected if it is below `7.15.0`.\n- Look for a multi-user deployment with distinct per-user home directories, since the flaw needs that configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["single-user","version-7.15.0-or-later"],"who_is_affected":"Multi-user FileGator deployments with distinct per-user home directories and users who have upload permission are exposed. Single-user installs or deployments where all users share one home directory are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4429,"output_tokens":476,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-94619':17A,20A '/upload':85C '7.15.0':83C,213C 'allow':174C 'anoth':62B,180C 'append':168C 'archiv':72B,188C 'assembl':133C 'attack':156C 'backend/controllers/uploadcontroller.php':87C 'chunk':171C 'configur':108C 'cve':15A,18A 'data':137C,169C 'delet':61B,178C 'deploy':107C 'directori':115C,159C,206C 'disclosur':175C 'distinct':110C 'exist':146C 'file':14A,32B,67B,79C,148C 'fileg':1A,21B,27B,73C 'filenam':39B,165C 'fix':210C 'handler':3A,141C 'home':114C,158C 'host':26B 'includ':185C 'issu':208C 'key':42B,97C 'let':4A 'limit':194C,200C 'lockfil':195C 'login':191C 'loop':134C 'low':7A,51B,118C 'low-privileg':6A,50B,117C 'manag':33B,80C 'modif':176C 'modifi':59B 'multi':30B,77C,105C 'multi-us':29B,76C,104C 'name':151C 'object':184C 'packag':22B 'path':166C,198C 'pend':65B,71B,187C 'per':112C 'per-us':111C 'permiss':56B,123C 'php':23B 'post':84C 'pre':145C 'pre-exist':144C 'primit':202C 'prior':81C 'privileg':8A,52B,119C 'rate':193C 'rate-limit':192C 'read':58B,142C 'remov':161C 'request':37B,91C 'request-suppli':36B,90C 'resumablefilenam':93C 'resumabletotalchunk':126C 'resumabletotals':128C 'sanit':199C 'self':25B 'self-host':24B 'set':125C 'share':44B,99C 'storag':46B,101C 'store':152C 'suppli':38B,92C,173C 'temp':13A 'temporari':45B,66B,100C,147C,205C 'tmpfs':197C 'touch':10A 'transient':183C 'unnamespac':96C 'upload':2A,48B,55B,122C 'use':34B,88C 'user':9A,12A,31B,53B,63B,78C,106C,113C,120C,181C 'version':212C 'write':135C 'zero':130C","nicknames":[],"mitigations":[],"who_affected":"Multi-user FileGator deployments with distinct per-user home directories and users who have upload permission are exposed. Single-user installs or deployments where all users share one home directory are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filegator","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':16A,19A '-94619':17A,20A 'cve':15A,18A 'file':14A 'fileg':1A 'handler':3A 'let':4A 'low':7A 'low-privileg':6A 'privileg':8A 'temp':13A 'touch':10A 'upload':2A 'user':9A,12A","search_b":"'anoth':62B 'archiv':72B 'delet':61B 'file':32B,67B 'fileg':21B,27B 'filenam':39B 'host':26B 'key':42B 'low':51B 'low-privileg':50B 'manag':33B 'modifi':59B 'multi':30B 'multi-us':29B 'packag':22B 'pend':65B,71B 'permiss':56B 'php':23B 'privileg':52B 'read':58B 'request':37B 'request-suppli':36B 'self':25B 'self-host':24B 'share':44B 'storag':46B 'suppli':38B 'temporari':45B,66B 'upload':48B,55B 'use':34B 'user':31B,53B,63B","search_c":"'/upload':85C '7.15.0':83C,213C 'allow':174C 'anoth':180C 'append':168C 'archiv':188C 'assembl':133C 'attack':156C 'backend/controllers/uploadcontroller.php':87C 'chunk':171C 'configur':108C 'data':137C,169C 'delet':178C 'deploy':107C 'directori':115C,159C,206C 'disclosur':175C 'distinct':110C 'exist':146C 'file':79C,148C 'fileg':73C 'filenam':165C 'fix':210C 'handler':141C 'home':114C,158C 'includ':185C 'issu':208C 'key':97C 'limit':194C,200C 'lockfil':195C 'login':191C 'loop':134C 'low':118C 'low-privileg':117C 'manag':80C 'modif':176C 'multi':77C,105C 'multi-us':76C,104C 'name':151C 'object':184C 'path':166C,198C 'pend':187C 'per':112C 'per-us':111C 'permiss':123C 'post':84C 'pre':145C 'pre-exist':144C 'primit':202C 'prior':81C 'privileg':119C 'rate':193C 'rate-limit':192C 'read':142C 'remov':161C 'request':91C 'request-suppli':90C 'resumablefilenam':93C 'resumabletotalchunk':126C 'resumabletotals':128C 'sanit':199C 'set':125C 'share':99C 'storag':101C 'store':152C 'suppli':92C,173C 'temporari':100C,147C,205C 'tmpfs':197C 'transient':183C 'unnamespac':96C 'upload':122C 'use':88C 'user':78C,106C,113C,120C,181C 'version':212C 'write':135C 'zero':130C","first_public_at":"2026-08-13T11:45:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94619","severity":null,"published_at":"2026-11-06T22:18:00+00:00","modified_at":"2026-11-06T22:18:00+00:00","first_seen_at":"2026-11-06T22:44:33+00:00","fetched_at":"2026-11-06T22:44:33+00:00","note":null}],"documents":[{"id":90798,"url":"https://github.com/filegator/filegator/commit/cae442a8323fddae7c8cee0924cdbb1aa6eea702","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90796,"url":"https://github.com/filegator/filegator/releases/tag/v7.15.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90800,"url":"https://github.com/filegator/filegator/security/advisories/GHSA-44r8-3p76-84mw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-13T11:45:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}