CVE-2026-63358 Details
Description
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
A vulnerability in FileGator allows for unauthorized privilege escalation. The issue arises in versions prior to 7.14.2, where the application accepts arbitrary Unix permission values through the '/chmoditems' API endpoint. These values are passed directly to PHP's 'chmod()' function after being converted with 'octdec()', without any validation. This flaw enables an authenticated user with 'chmod' permission to elevate their privileges to root.
Users are advised to upgrade to FileGator version 7.14.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Release Notes |
| https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Patch |
| https://github.com/filegator/filegator/tree/master | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Product |
| https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | VDB Entry |
| https://www.cve.org/CVERecord?id=CVE-2026-63358 | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | VDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
Affected Products
| Product | Versions |
|---|---|
| filegator filegator | < 7.14.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |