FileGator < 7.14.2 - Privilege Escalation

id: CVE-2026-63358

info:
  name: FileGator < 7.14.2 - Privilege Escalation
  author: moizxsec
  severity: high
  description: |
    FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
  impact: |
    An authenticated user with the chmod permission can assign arbitrary Unix permissions (e.g. setuid or world-writable), leading to privilege escalation.
  remediation: |
    Upgrade to FileGator 7.14.2 or later.
  reference:
    - https://github.com/advisories/GHSA-9m9p-7p6h-xv99
    - https://www.cve.org/CVERecord?id=CVE-2026-63358
    - https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18
    - https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
    cvss-score: 7.3
    cve-id: CVE-2026-63358
    epss-score: 0.00169
    epss-percentile: 0.05687
    cwe-id: CWE-732
    cpe: cpe:2.3:a:filegator:filegator:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: filegator
    product: filegator
    shodan-query: http.title:"FileGator"
    fofa-query: title="FileGator"
  tags: cve,cve2026,filegator,privesc

http:
  - raw:
      - |
        GET /?r=/getconfig HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /index.php?r=/getconfig HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "\"app_name\"", "FileGator", "\"app_version\"")'
          - 'contains(content_type, "application/json")'
          - 'compare_versions(version, "< 7.14.2")'
        condition: and

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - '"app_version":\s*"([0-9.]+)"'

      - type: regex
        part: body
        group: 1
        regex:
          - '"app_version":\s*"([0-9.]+)"'
# digest: 4b0a00483046022100812c4a98774ed98498f339028ea080a2a48d6de1c4888a549f63997c8b988f3c022100d24c0adce314c1c644bc1bd1f3db5517f2a19c93e92e6de2118732e230f20499:922c64590222798bb761d5b6d8e72950