CVE-2026-94619

Name of the Vulnerable Software and Affected Versions FileGator versions prior to 7.15.0

Description The application uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage within the 'POST /upload' endpoint in backend/Controllers/UploadController.php. In multi-user deployments with distinct home directories, a low-privileged user with upload permissions can manipulate resumableTotalChunks and resumableTotalSize by setting them to zero. This prevents the assembly loop from writing data, causing the handler to read a pre-existing temporary file with the specified name, move it to the attacker's home directory, and delete the original. This mechanism allows for the disclosure, modification, or deletion of another user's transient objects, such as pending archives or login rate-limit lockfiles, although Tmpfs path sanitization restricts this action to the temporary directory.

Recommendations Update to version 7.15.0.