https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 03:32:35 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-94618 <p>FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user&#39;s active archive id can cross that boundary and retrieve the victim&#39;s batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim&#39;s pending archive. This issue is fixed in version 7.15.0.</p> <p>FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user&#39;s active archive id can cross that boundary and retrieve the victim&#39;s batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim&#39;s pending archive. This issue is fixed in version 7.15.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-94618 https://db.gcve.eu/vuln/ghsa-f74m-x83r-c4v4 <p><strong>Affected:</strong> Packagist: filegator/filegator</p> <p>### Summary `GET /batchdownload` streams a batch ZIP to any requester who supplies its `uniqid`, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user&#39;s batch archive, disclosing files the per-user boundary otherwise protects. Reported with explicit preconditions and bounded impact — not a universal &#34;any user steals any file&#34; issue.</p> <p>### Details The archive id is generated with plain `uniqid()` and no ownership metadata is bound to it before streaming.</p> <p>- `backend/Services/Archiver/Adapters/ZipArchiver.php:44` — `createArchive()` uses plain `uniqid()`. - `backend/Controllers/DownloadController.php:144-145` — `batchDownloadStart()` reads the tmpfs file by the request-supplied `uniqid` after only a charset `preg_replace()`. - `backend/Controllers/DownloadController.php:158` — the tmpfs archive is removed only after streaming. - `backend/Controllers/routes.php:207-226` — both batch endpoints are exposed to normal roles with `read`, `download`, `batchdownload`.</p> <p>No user id, session id, home directory, or creator check is applied before streaming. The code path is unchanged since commit `3f03a40` (2022-05-31) and is present in the latest release `v7.14.3`.</p> <p>### PoC Preconditions: a multi-user deployment with distinct per-user `homedir`s (set per-user in `users.json`, or `private_repos =&gt; true` on the WordPress/LDAP adapter). The sh…</p> <p><strong>Affected:</strong> Packagist: filegator/filegator</p> <p>### Summary `GET /batchdownload` streams a batch ZIP to any requester who supplies its `uniqid`, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user&#39;s batch archive, disclosing files the per-user boundary otherwise protects. Reported with explicit preconditions and bounded impact — not a universal &#34;any user steals any file&#34; issue.</p> <p>### Details The archive id is generated with plain `uniqid()` and no ownership metadata is bound to it before streaming.</p> <p>- `backend/Services/Archiver/Adapters/ZipArchiver.php:44` — `createArchive()` uses plain `uniqid()`. - `backend/Controllers/DownloadController.php:144-145` — `batchDownloadStart()` reads the tmpfs file by the request-supplied `uniqid` after only a charset `preg_replace()`. - `backend/Controllers/DownloadController.php:158` — the tmpfs archive is removed only after streaming. - `backend/Controllers/routes.php:207-226` — both batch endpoints are exposed to normal roles with `read`, `download`, `batchdownload`.</p> <p>No user id, session id, home directory, or creator check is applied before streaming. The code path is unchanged since commit `3f03a40` (2022-05-31) and is present in the latest release `v7.14.3`.</p> <p>### PoC Preconditions: a multi-user deployment with distinct per-user `homedir`s (set per-user in `users.json`, or `private_repos =&gt; true` on the WordPress/LDAP adapter). The sh…</p> https://db.gcve.eu/vuln/ghsa-f74m-x83r-c4v4