CVE-2026-94618 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with...

EUVD-2026-118519

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with...

CVE-2026-94618

The FileGator multi-user file manager is vulnerable to a cross-user archive retrieval due to a missing authorization check. In versions prior to 7.15.0 , the GET /batchdownload endpoint in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream archives based on a request-s...