CVE-2026-94618: Missing Authorization and Weak Archive Identifier Generation in FileGator Batch Download

Vulnerability ID: CVE-2026-94618
CVSS Score: 5.4
Published: 2026-11-09

FileGator versions prior to 7.15.0 contain a missing authorization check (CWE-862) and predictable identifier generation flaw (CWE-330) in the batch download implementation. When a user initiates a batch download, FileGator generates a temporary ZIP archive identified by PHP's non-cryptographic uniqid() function without binding the resulting identifier to the creating user's session. Consequently, any authenticated user with read, download, and batchdownload permissions who obtains or predicts an active archive identifier can retrieve another user's private files via GET /batchdownload, bypassing per-user home directory isolation and deleting the victim's temporary archive upon download completion.

TL;DR

An Insecure Direct Object Reference (IDOR) and weak token generation flaw in FileGator (< 7.15.0) allows authenticated users to download and consume other users' temporary batch ZIP archives via GET /batchdownload by supplying a predicted or intercepted uniqid token.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-94618
• Primary CWE: CWE-862 (Missing Authorization) & CWE-330 (Use of Insufficiently Random Values)
• CVSS v3.1 Score: 5.4 Medium (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L)
• Attack Vector: Network (Authenticated HTTP GET request to /batchdownload)
• Affected Component: DownloadController::batchDownloadStart() & ZipArchiver::createArchive()
• Security Impact: Cross-user batch archive exfiltration and deletion of victim's pending archive
• Exploit Status: Proof-of-Concept (Included in repository PHPUnit regression suite)
• Patched Version: FileGator 7.15.0

Affected Systems

• filegator/filegator
• FileGator: < 7.15.0 (Fixed in: 7.15.0)

Code Analysis

Commit: 638737e

Bind batch download archives to creating session and replace uniqid() with random_bytes(32)

diff --git a/backend/Controllers/DownloadController.php b/backend/Controllers/DownloadController.php
index 6c2faffa..066b8f59 100644
--- a/backend/Controllers/DownloadController.php
+++ b/backend/Controllers/DownloadController.php
@@ -24,6 +24,14 @@

 class DownloadController
 {
+    const BATCH_ARCHIVES_SESSION_KEY = 'batch_download_archives';
+    const BATCH_ARCHIVES_LIMIT = 20;
+
     protected $auth;

     protected $session;
@@ -122,6 +130,10 @@ public function batchDownloadCreate(Request $request, Response $response, Archiv

         $uniqid = $archiver->createArchive($this->storage);

+        $this->rememberBatchArchive($uniqid);
+
         // close session
         $this->session->save();

@@ -139,9 +151,17 @@ public function batchDownloadCreate(Request $request, Response $response, Archiv
         return $response->json(['uniqid' => $uniqid]);
     }

-    public function batchDownloadStart(Request $request, StreamedResponse $streamedResponse, TmpfsInterface $tmpfs)
+    public function batchDownloadStart(Request $request, Response $response, StreamedResponse $streamedResponse, TmpfsInterface $tmpfs)
     {
         $uniqid = (string) preg_replace('/[^0-9a-zA-Z_]/', '', (string) $request->input('uniqid'));
+
+        if (! $this->ownsBatchArchive($uniqid)) {
+            return $response->redirect('/');
+        }
+
         $file = $tmpfs->readStream($uniqid);

Commit: 13e8307

Release version 7.15.0

Exploit Details

• GitHub Fix Commit & Regression Test Suite: Official patch commit containing automated PHPUnit reproduction test (BatchDownloadAuthorizationTest.php) demonstrating cross-user batch archive retrieval.

Mitigation Strategies

• Upgrade FileGator to version 7.15.0 or later to enforce session-level ownership binding and cryptographically secure archive identifiers.
• Revoke the 'batchdownload' permission for standard multi-tenant users if immediate patching is not possible.
• Configure reverse proxies and logging pipelines to redact query parameters on /batchdownload endpoints and strip Referer headers.

Remediation Steps:

1. Update the filegator/filegator Composer package or deploy the official v7.15.0 release archive.
2. Verify that backend/Controllers/DownloadController.php checks $this->ownsBatchArchive($uniqid) inside batchDownloadStart().
3. Verify that backend/Services/Archiver/Adapters/ZipArchiver.php generates archive IDs using bin2hex(random_bytes(32)).
4. Audit web server access logs for rapid sequential GET /batchdownload requests with 13-character hexadecimal uniqid values or identical uniqid values requested across different IP addresses.

References

• GitHub Security Advisory GHSA-f74m-x83r-c4v4
• FileGator Pull Request #597
• FileGator Patch Commit 638737e560cbf20cbeb5da4e4e6c974f8a080531
• FileGator Release Commit 13e8307a1a4474db3f21b9138c0fa2a54512ee13
• FileGator v7.15.0 Release Notes
• NVD - CVE-2026-94618
• CVE.org Record - CVE-2026-94618
• CVE List V5 JSON Record - CVE-2026-94618

Read the full report for CVE-2026-94618 on our website for more details including interactive diagrams and full exploit analysis.