CVE-2026-63358 | FileGator accepts arbitrary Unix permission values via the '… | CVSS 7.3 HIGH

Description

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Metadata

CVE ID: CVE-2026-63358
State: PUBLISHED
Assigner: cisa-cg
Reserved: 2026-07-16 14:46 UTC
Published: 2026-07-21 20:13 UTC
Last updated: 2026-07-21 20:13 UTC
Primary CWE: CWE-732
CWE-732 Incorrect Permission Assignment for Critical Resourc…
Vendor / Product: FileGator / FileGator
Sources: cve.org · NVD

Severity & Metrics

7.3 HIGH CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Affected products (1)

Vendor	Product	Platform	Versions
FileGator	FileGator	—	0 < 7.14.2, 7.14.2

Weakness (CWE)

CWE	Source	Description
CWE-732	cna	CWE-732 Incorrect Permission Assignment for Critical Resource

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.4	HIGH	4.0	cna	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
7.3	HIGH	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References (5)