CVE-2026-63358highCWE-732

CVE-2026-63358: falha de alta gravidade em FileGator

FileGator privilege escalation

Publicada em 21 jul 2026 · Atualizada em 30 jul 2026

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.4epss 0.5%

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Produtos afetados

FileGator · FileGator

Referências

https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c https://github.com/filegator/filegator/tree/master https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json https://www.cve.org/CVERecord?id=CVE-2026-63358