FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker's home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user's transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…egator/security/advisories/GHSA-44r8-3p76-84mw Diğer
• github.com/filegator/filegator/pull/598 Diğer
• github.com/…ommit/cae442a8323fddae7c8cee0924cdbb1aa6eea702 Diğer
• github.com/filegator/filegator/releases/tag/v7.15.0 Diğer

Kayıt geçmişi

1. 7 Kas 2026 00:32Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-94618FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
• 8,8 CVE-2026-50240Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-eq…
• 5,9 CVE-2026-77442Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any u…
• 6,5 CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
• 6,5 CVE-2026-634372FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration
• 6,5 CVE-2026-63664CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass