4 matches found
GHSA-F74M-X83R-C4V4 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
Summary GET /batchdownload streams a batch ZIP to any requester who supplies its uniqid, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user's...
FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
Summary GET /batchdownload streams a batch ZIP to any requester who supplies its uniqid, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user's...
CVE-2026-94618 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with...
CVE-2026-94618 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with...