CVE-2026-63358CWE-732

CVE-2026-63358

High · published July 22, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00509 · 42.6th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-07-22T01:16Z
Affected products (1)
ProductVersionsFixed in
filegator/filegator< 7.14.27.14.2
References (5)
https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 · 9119a7d8-5eab-497f-8521-727c672e3725https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c · 9119a7d8-5eab-497f-8521-727c672e3725https://github.com/filegator/filegator/tree/master · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-63358 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 21 JUL 20:13Z
    FileGator privilege escalation
    cvelistv5