FileGator < 7.14.2 - Privilege Escalation

highseverity

7.3CVSS score

0.5%likelihood of exploitation, next 30 days

44%of all CVEs are less likely

Readycheck to confirm it

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Impact

An authenticated user with the chmod permission can assign arbitrary Unix permissions (e.g. setuid or world-writable), leading to privilege escalation.

Fix

Upgrade to FileGator 7.14.2 or later.

How to confirm it

Send: GET /?r=/getconfig ; GET /index.php?r=/getconfig
Positive when: contains_all(body, "\"app_name\"", "FileGator", "\"app_version\"") and contains(content_type, "application/json") and compare_versions(version, "< 7.14.2")

Run it with nuclei: nuclei -id CVE-2026-63358 -u <target>

The full check

id: CVE-2026-63358

info:
  name: FileGator < 7.14.2 - Privilege Escalation
  author: moizxsec
  severity: high
  description: |
    FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.
  impact: |
    An authenticated user with the chmod permission can assign arbitrary Unix permissions (e.g. setuid or world-writable), leading to privilege escalation.
  remediation: |
    Upgrade to FileGator 7.14.2 or later.
  reference:
    - https://github.com/advisories/GHSA-9m9p-7p6h-xv99
    - https://www.cve.org/CVERecord?id=CVE-2026-63358
    - https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18
    - https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
    cvss-score: 7.3
    cve-id: CVE-2026-63358
    epss-score: 0.00509
    epss-percentile: 0.43806
    cwe-id: CWE-732
    cpe: cpe:2.3:a:filegator:filegator:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: filegator
    product: filegator
    shodan-query: http.title:"FileGator"
    fofa-query: title="FileGator"
  tags: cve,cve2026,filegator,privesc

http:
  - raw:
      - |
        GET /?r=/getconfig HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /index.php?r=/getconfig HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "\"app_name\"", "FileGator", "\"app_version\"")'
          - 'contains(content_type, "application/json")'
          - 'compare_versions(version, "< 7.14.2")'
        condition: and

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - '"app_version":\s*"([0-9.]+)"'

      - type: regex
        part: body
        group: 1
        regex:
          - '"app_version":\s*"([0-9.]+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from