FileGator Multi-User File Manager Vulnerability

CVE-2026-94619

What is CVE-2026-94619?

In FileGator, prior to version 7.15.0, a vulnerability exists in the upload functionality where a low-privileged user can exploit the resumableFilename parameter. By manipulating this parameter, the attacker can create conditions that lead to the disclosure, modification, or deletion of another user's files within temporary storage. This is facilitated through a scenario where the assembler loop writes no data due to zeroed chunk size parameters, allowing an attacker to read existing temporary files belonging to others and store them in their home directory. This issue has been addressed in version 7.15.0, ensuring better protection against unauthorized access.

References