PT-2026-62098 · Filegator · Filegator

Abdul Moiz · CVE-2026-63358 · Publicado 2026-07-21 · Atualizado 2026-07-21

Mitre

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2026-63358

Produtos afetados

Filegator

Referências · 6

• https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c · Correção
• https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 · Nota
• https://github.com/filegator/filegator/tree/master · Nota
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63358 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2026-63358 · Nota de Segurança