https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 07:54:44 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-94619 <p>FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker&#39;s home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user&#39;s transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0.</p> <p>FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with upload permission can set resumableTotalChunks and resumableTotalSize to zero so the assembly loop writes no data, after which the handler reads a pre-existing temporary file with that name, stores it in the attacker&#39;s home directory, and removes it. The same filename path can append data when chunks are supplied, allowing disclosure, modification, or deletion of another user&#39;s transient object, including a pending archive or the login rate-limit lockfile, while Tmpfs path sanitization limits the primitive to the temporary directory. This issue is fixed in version 7.15.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-94619 https://db.gcve.eu/vuln/ghsa-44r8-3p76-84mw <p><strong>Affected:</strong> Packagist: filegator/filegator</p> <p>## Summary</p> <p>`POST /upload` uses the request-supplied `resumableFilename` directly as a key into the shared temporary directory, without the character filter it applies to `resumableIdentifier` and without namespacing it per user. A valid user holding the `upload` permission can read any file in that directory into their own home directory, append to it, and delete it.</p> <p>This reproduces the cross-user batch-archive disclosure of GHSA-f74m-x83r-c4v4 through a different route — it still works with the fix for that advisory (PR #597) applied — and additionally allows deleting the login rate-limit lockfile.</p> <p>Reported with explicit preconditions and bounded impact, as before: the primitive is confined to the temporary directory, not the whole filesystem.</p> <p>## Details</p> <p>- `backend/Controllers/UploadController.php:61` — `$file_name = $request-&gt;input(&#39;resumableFilename&#39;, &#39;file&#39;)` is **not** passed through the `preg_replace(&#39;/[^0-9a-zA-Z_]/&#39;, &#39;&#39;, ...)` that line 66 applies to `resumableIdentifier`. - Line 88 builds `$prefix` namespaced by the sanitized username, but `$file_name` reaches the temporary storage at lines 118, 121 and 125 **without** that prefix. - Line 115 — `if ($chunks_size &gt;= $total_size)` is entered whenever `resumableTotalSize` is `0`. - Lines 116-119 — the assembly loop `for ($i = 1; $i &lt;= $total_chunks; ++$i)` does not execute when `resumableTotalChunks` is `0`, so nothing is written to `$file_name`. - Line 121 — `readStream($file_name)` therefore reads the pre-existi…</p> <p><strong>Affected:</strong> Packagist: filegator/filegator</p> <p>## Summary</p> <p>`POST /upload` uses the request-supplied `resumableFilename` directly as a key into the shared temporary directory, without the character filter it applies to `resumableIdentifier` and without namespacing it per user. A valid user holding the `upload` permission can read any file in that directory into their own home directory, append to it, and delete it.</p> <p>This reproduces the cross-user batch-archive disclosure of GHSA-f74m-x83r-c4v4 through a different route — it still works with the fix for that advisory (PR #597) applied — and additionally allows deleting the login rate-limit lockfile.</p> <p>Reported with explicit preconditions and bounded impact, as before: the primitive is confined to the temporary directory, not the whole filesystem.</p> <p>## Details</p> <p>- `backend/Controllers/UploadController.php:61` — `$file_name = $request-&gt;input(&#39;resumableFilename&#39;, &#39;file&#39;)` is **not** passed through the `preg_replace(&#39;/[^0-9a-zA-Z_]/&#39;, &#39;&#39;, ...)` that line 66 applies to `resumableIdentifier`. - Line 88 builds `$prefix` namespaced by the sanitized username, but `$file_name` reaches the temporary storage at lines 118, 121 and 125 **without** that prefix. - Line 115 — `if ($chunks_size &gt;= $total_size)` is entered whenever `resumableTotalSize` is `0`. - Lines 116-119 — the assembly loop `for ($i = 1; $i &lt;= $total_chunks; ++$i)` does not execute when `resumableTotalChunks` is `0`, so nothing is written to `$file_name`. - Line 121 — `readStream($file_name)` therefore reads the pre-existi…</p> https://db.gcve.eu/vuln/ghsa-44r8-3p76-84mw