Read the docs
TI-2026-86146 Aliases CVE-2026-94618

Missing authorization in FileGator batch download exposes archives

Priority LOW 24CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

FileGator before 7.15.0 lacks an authorization check (CWE-862) on GET /batchdownload. The endpoint serves a temporary archive selected by id without verifying that the current session created it. A user with read, download and batchdownload permissions who obtains another user's active archive id can retrieve that archive in deployments with separate home directories. The retrieval also deletes the victim's pending archive, and exploitation needs both the id and user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.

Why it matters now

EPSS 0.00189 8th percentileScored 2026-11-07
Fix Fixed filegator (filegator): 7.15.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
filegatorfilegatorbefore 7.15.07.15.0Patch availableCNA
  • filegator Vendorfilegator Affected before 7.15.0 Fixed in 7.15.0 Patch available CNA

Remediation

Upgrade FileGator to version 7.15.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA filegator (filegator) Fixed in 7.15.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-94618
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-45171 FileGator privilege escalation CVSS 4.0HIGH 8.4
  • TI-2022-01714 Path Traversal in filegator/filegator CVSS 3.1HIGH 8.1
  • TI-2026-86147 Missing authorization in FileGator lets users read others' temp files CVSS 3.1MEDIUM 5.9
  • TI-2022-01713 Session Fixation in filegator/filegator CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences