CVE-2026-94618

The FileGator multi-user file manager is vulnerable to a cross-user archive retrieval due to a missing authorization check. In versions prior to 7.15.0 , the GET /batchdownload endpoint in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream archives based on a request-s...