Filegator
Monthly
Privilege escalation in FileGator (the open-source self-hosted PHP web file manager) lets an authenticated user who holds the 'chmod' permission set arbitrary Unix file modes via the '/chmoditems' API endpoint, ultimately elevating to root. The endpoint forwards attacker-supplied values straight to PHP's chmod() through octdec() with no validation or allow-listing, so a low-privileged operator can make sensitive binaries or files setuid/world-writable and gain full control of the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS was not provided.
Session Fixation in GitHub repository filegator/filegator prior to 7.8.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Path Traversal in GitHub repository filegator/filegator prior to 7.8.0. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Privilege escalation in FileGator (the open-source self-hosted PHP web file manager) lets an authenticated user who holds the 'chmod' permission set arbitrary Unix file modes via the '/chmoditems' API endpoint, ultimately elevating to root. The endpoint forwards attacker-supplied values straight to PHP's chmod() through octdec() with no validation or allow-listing, so a low-privileged operator can make sensitive binaries or files setuid/world-writable and gain full control of the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS was not provided.
Session Fixation in GitHub repository filegator/filegator prior to 7.8.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Path Traversal in GitHub repository filegator/filegator prior to 7.8.0. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.