/Vulnerability Library

FileGator < 7.14.2 - Privilege Escalation

CVE-2026-63358
Early Release

Description

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Severity

High

CVSS Score

7.3

Exploit Probability

0%

Affected Product

filegator

Published Date

September 29, 2026

Template Author

moizxsec

CVE-2026-63358.yaml
7.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVE ID:
cve-2026-63358
CWE ID:
cwe-732

References

https://github.com/advisories/GHSA-9m9p-7p6h-xv99https://www.cve.org/CVERecord?id=CVE-2026-63358https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c

Remediation Steps

Upgrade to FileGator 7.14.2 or later.