https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 03:00:06 +0000 https://db.gcve.eu/vuln/cve-2026-94618 <p><strong>Affected:</strong> filegator</p> <p>FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user&#39;s active archive id can cross that boundary and retrieve the victim&#39;s batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim&#39;s pending archive. This issue is fixed in version 7.15.0.</p> <p><strong>Affected:</strong> filegator</p> <p>FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user&#39;s active archive id can cross that boundary and retrieve the victim&#39;s batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim&#39;s pending archive. This issue is fixed in version 7.15.0.</p> https://db.gcve.eu/vuln/cve-2026-94618