CVE-2026-94618

Name of the Vulnerable Software and Affected Versions FileGator versions prior to 7.15.0

Description The application fails to verify if the current session created the temporary archive requested via the uniqid parameter. An authenticated user with read, download, and batchdownload permissions can retrieve another user's batch archive by obtaining its active archive ID. This occurs at the '/batchdownload' endpoint within the batchDownloadStart() function. A successful exploitation also results in the deletion of the victim's pending archive.

Recommendations Update to version 7.15.0.