Which versions of FileGator are affected by CVE-2026-63358?

FileGator, a self-hosted file management system, contains a privilege escalation vulnerability (CVE-2026-63358, CVSS 8.4) that allows authenticated users with chmod permissions to escalate to root…. A patch is available.

How to fix or mitigate CVE-2026-63358?

Within 24 hours: Audit FileGator user permissions and restrict 'chmod' access to only essential administrators; review audit logs for any suspicious /chmoditems endpoint activity. Within 7 days: Apply the available vendor patch to all FileGator instances after testing in a staging environment to ensure operational compatibility. Within 30 days: Validate system file integrity on all affected servers, implement principle-of-least-privilege access controls to minimize chmod permission holders, and establish monitoring for unauthorized permission change attempts.

FileGator CVE-2026-63358

Q: What is the CVSS score of CVE-2026-63358?

CVE-2026-63358 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-46401 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-07-21 cisa-cg

GHSA-9m9p-7p6h-xv99

Information Disclosure Filegator

8.4

CVSS 4.0 · Vendor: cisa-cg

Severity by source

Vendor (cisa-cg) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Reachable via authenticated HTTP API (AV:N/PR:L); unvalidated chmod escapes the app into OS-level root control, so scope changes (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 21:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jul 21, 2026 - 21:22 NVD

7.3 (HIGH) 8.4 (HIGH)

Source Code Evidence Fetched

Jul 21, 2026 - 21:01 vuln.today

Analysis Generated

Jul 21, 2026 - 21:01 vuln.today

CVE Published

Jul 21, 2026 - 20:13 cve.org

HIGH 7.3

DescriptionCVE.org

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

AnalysisAI

Privilege escalation in FileGator (the open-source self-hosted PHP web file manager) lets an authenticated user who holds the 'chmod' permission set arbitrary Unix file modes via the '/chmoditems' API endpoint, ultimately elevating to root. The endpoint forwards attacker-supplied values straight to PHP's chmod() through octdec() with no validation or allow-listing, so a low-privileged operator can make sensitive binaries or files setuid/world-writable and gain full control of the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS was not provided.

Technical ContextAI

FileGator is a standalone PHP application (single affected CPE cpe:2.3:a:filegator:filegator) that manages files on the server's local filesystem on behalf of authenticated users. The '/chmoditems' action is intended to let permitted users change file modes, but it converts the client-supplied string with octdec() and hands the raw integer to PHP's native chmod() without bounding it to a safe set. This is a textbook CWE-732 (Incorrect Permission Assignment for a Critical Resource): because the application process can chmod files it owns or has write access to, an attacker can grant setuid/setgid or world-writable bits and pivot to root-level control of files the web stack touches.

RemediationAI

Upgrade to the patched FileGator release referenced in the vendor changelog - version 7.14.2 (2026-05-18) - and apply commit 4a44ed9a43f84505703dce669c68fb55270c3f2c (https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c). Until patched, revoke the 'chmod' permission from all non-administrative roles so ordinary users cannot reach the vulnerable code path (trade-off: users lose the ability to change file modes through the UI), and restrict network access to the FileGator interface to trusted administrators only via authentication proxy or IP allow-listing. As additional hardening, run the FileGator PHP process under a dedicated low-privilege, unprivileged account with no ownership of setuid-capable or system files so a successful chmod cannot escalate to root (trade-off: requires filesystem ownership review and may break existing workflows). Consult the CISA CSAF advisory va-26-202-03 for vendor guidance.