CVE-2026-63358

EUVD-2026-46401
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.43%
Affected Products (NVD)
VendorProductVersion
filegatorfilegator
𝑥
< 7.14.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18
https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c
https://github.com/filegator/filegator/tree/master
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json
https://www.cve.org/CVERecord?id=CVE-2026-63358