CVE-2026-63358highCWE-732

FileGator privilege escalation

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.4epss 0.1%

probabilidad de explotación

0.1%top 98% de las CVE

explotación observada

noninguna fuente lo reporta

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Productos afectados

FileGator · FileGator

Referencias

https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c https://github.com/filegator/filegator/tree/master https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json https://www.cve.org/CVERecord?id=CVE-2026-63358