CVE-2026-63358highCWE-732

CVE-2026-63358: fallo de gravedad alta en FileGator

FileGator privilege escalation

Publicada el 21 jul 2026 · Actualizada el 30 jul 2026

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.4epss 0.5%

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Productos afectados

FileGator · FileGator

Referencias

https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c https://github.com/filegator/filegator/tree/master https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json https://www.cve.org/CVERecord?id=CVE-2026-63358