CVE-2026-63358

EUVD-2026-46401
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
cisa-cgCNA
7.3 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
filegatorfilegator
𝑥
< 7.14.2
CNA
Common Weakness Enumeration
References
https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18
https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c
https://github.com/filegator/filegator/tree/master
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json
https://www.cve.org/CVERecord?id=CVE-2026-63358