Skip to content
OpenAdvisories
High VA-26-202-03 1 CVE

FileGator privilege escalation

Published Jul 21, 2026 · Updated Jul 21, 2026

Vendor: FileGator Product: FileGator

Summary

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Vulnerabilities 1

  • High 7.3
    CVE-2026-63358 Scanner template

    FileGator privilege escalation

    FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission…

    FileGator FileGator

Revision history

  1. #1.0.0

    Initial publication