---
id: "CVE-2026-94619"
page: "https://infrastack.ai/live/CVE-2026-94619"
kind: "vulnerability"
aliases: ["CVE-2026-94619"]
title: "FileGator: upload handler lets a low-privileged user touch other users' temp files"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["filegator", "package", "php", "self-hosted"]
not_affected_if: ["single-user", "version-7.15.0-or-later"]
published_at: "2026-11-06T22:18:00+00:00"
first_seen_at: "2026-11-06T22:44:33+00:00"
updated_at: "2026-11-06T22:44:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94619", "first_seen_at": "2026-11-06T22:44:33+00:00"}]
exploit_sources: []
---

# FileGator: upload handler lets a low-privileged user touch other users' temp files

Link for people: https://infrastack.ai/live/CVE-2026-94619 (this .md is for agents)

FileGator, a multi-user file manager, uses a request-supplied filename as a key in shared temporary storage during uploads. A low-privileged user with upload permission can read, modify, or delete another user's pending temporary file, such as a pending archive.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FileGator version in use; affected if it is below `7.15.0`.
- Look for a multi-user deployment with distinct per-user home directories, since the flaw needs that configuration.

## Fix

- Move to FileGator `7.15.0` or later.

## Timeline

- 2026-11-06T22:44:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94619

## Documents

- [advisory] Vendor advisory: github.com https://github.com/filegator/filegator/security/advisories/GHSA-44r8-3p76-84mw
- [fix] Patch: github.com https://github.com/filegator/filegator/commit/cae442a8323fddae7c8cee0924cdbb1aa6eea702
- [fix] Release notes: github.com https://github.com/filegator/filegator/releases/tag/v7.15.0

## From the sources

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker's home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user's transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_