FileGator Multi-User File Manager Vulnerability in Download Controller
CVE-2026-94618

5.4MEDIUM

Key Information:

Vendor

Filegator

Status
Filegator
Vendor
CVE Published:
6 November 2026

What is CVE-2026-94618?

The vulnerability in FileGator allows a valid user to exploit inadequacies in the DownloadController.php by accessing another user's batch downloads. This occurs due to a lack of session validation during the batch download process, enabling an attacker to retrieve files not intended for them. Even with limited prospect for exploitation due to the archive's lifetime and id-acquisition protocols, successful access not only compromises data confidentiality but also deletes the original user's pending archive. Mitigation is available in version 7.15.0.

Affected Version(s)

filegator < 7.15.0

References

https://github.com/filegator/filegator/security/advisorie...
x_refsource_CONFIRM
https://github.com/filegator/filegator/pull/597
x_refsource_MISC
https://github.com/filegator/filegator/commit/638737e560c...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.