CVE-2026-94619 FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...