CVE-2026-63358

High

Description

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

SeverityHigh

CVSS7.3

Exploit probability—

ProductFilegator

PublishedJul 21, 2026

First seenJul 21, 2026

Weakness typeCWE-732CWE-732

How to fix

Update

filegator filegator7.14.2 or later

Patches

github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c

Vendor advisories

github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18

Affected products

Product	Affected versions	Fixed in
filegator filegator	v < 7.14.2	7.14.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.