CVE-2026-63358

7.3 Élevée

Publiée le 21/07/2026 à 23:16 · Modifiée le 05/08/2026 à 21:44 · Analysée par le NVD · Source : 9119a7d8-5eab-497f-8521-727c672e3725

Description

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Traduire en français

Produits concernés

FileGator
Filegator filegator

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.4 Élevée	9119a7d8-5eab-497f-8521-727c672e3725	`CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.3 Élevée	9119a7d8-5eab-497f-8521-727c672e3725	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-732

Références

https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 Release Notes
https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c Patch
https://github.com/filegator/filegator/tree/master Product
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json VDB Entry
https://www.cve.org/CVERecord?id=CVE-2026-63358 VDB Entry

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories