FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…egator/security/advisories/GHSA-f74m-x83r-c4v4 Diğer
• github.com/filegator/filegator/pull/597 Diğer
• github.com/…ommit/638737e560cbf20cbeb5da4e4e6c974f8a080531 Diğer
• github.com/filegator/filegator/releases/tag/v7.15.0 Diğer

Kayıt geçmişi

1. 7 Kas 2026 00:30Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-94619FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files
• 8,8 CVE-2026-50240Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-eq…
• 5,9 CVE-2026-77442Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any u…
• 6,5 CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
• 6,5 CVE-2026-634372FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration
• 6,5 CVE-2026-63664CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass