CVE-2026-94618 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with...