CVE-2026-94619: Missing Authorization and Unnamespaced Temporary File Reassembly in FileGator UploadController

Vulnerability ID: CVE-2026-94619
CVSS Score: 5.9
Published: 2026-11-09

An authorization bypass and insecure direct object reference (IDOR) vulnerability exists in FileGator versions prior to 7.15.0 within the chunked file upload reassembly handler. When processing multipart uploads in backend/Controllers/UploadController.php, the application fails to namespace the target assembly filename with a user-specific prefix inside the shared temporary storage directory. Authenticated users with upload privileges can manipulate chunk metadata parameters to exfiltrate, corrupt, or delete arbitrary transient files belonging to other users or the system.

TL;DR

FileGator prior to 7.15.0 uses an unnamespaced filename during chunked upload reassembly in shared temporary storage. By sending an upload request with resumableTotalChunks=0 and resumableTotalSize=0, an authenticated attacker can skip chunk concatenation and cause the server to move any existing temporary file (such as another user's batch download ZIP archive or an IP lockfile) into the attacker's home directory.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-94619 (GHSA-44r8-3p76-84mw)
• Weakness Class: CWE-862: Missing Authorization
• Attack Vector: Network (Authenticated HTTP POST to /upload)
• CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L)
• EPSS Score: 0.171% (6.54th percentile)
• Impact: Cross-user temporary file disclosure, tampering, and deletion
• Exploit Status: PoC Available (Vendor regression test)
• CISA KEV Status: Not Listed

Affected Systems

• FileGator < 7.15.0
• filegator: < 7.15.0 (Fixed in: 7.15.0)

Code Analysis

Commit: cae442a

Namespace assembled upload file with user prefix and verify existence before storing

diff --git a/backend/Controllers/UploadController.php b/backend/Controllers/UploadController.php
index 0299de18..4d00f866 100644
--- a/backend/Controllers/UploadController.php
+++ b/backend/Controllers/UploadController.php
@@ -113,16 +113,26 @@ public function upload(Request $request, Response $response)

         // if all the chunks are present, create final file and store it
         if ($chunks_size >= $total_size) {
+            // Assemble the chunks into a temporary file kept inside this request's
+            // own namespace ($prefix already encodes the user), so the assembly can
+            // never read, write or delete another user's temporary files.
+            $assembled = $prefix.$file_name;
+
             for ($i = 1; $i <= $total_chunks; ++$i) {
                 $part = $this->tmpfs->readStream($prefix.$file_name.'.part'.$i);
-                $this->tmpfs->write($file_name, $part['stream'], true);
+                $this->tmpfs->write($assembled, $part['stream'], true);
             }

-            $final = $this->tmpfs->readStream($file_name);
-            $res = $this->storage->store($destination, $final['filename'], $final['stream'], $overwrite_on_upload);
+            $res = false;
+            if ($this->tmpfs->exists($assembled)) {
+                $final = $this->tmpfs->readStream($assembled);
+                // the stored name is the sanitized file name without the prefix
+                $name = substr($final['filename'], strlen($prefix));
+                $res = $this->storage->store($destination, $name, $final['stream'], $overwrite_on_upload);
+                $this->tmpfs->remove($assembled);
+            }

             // cleanup
-            $this->tmpfs->remove($file_name);
             foreach ($this->tmpfs->findAll($prefix.'*') as $expired_chunk) {
                 $this->tmpfs->remove($expired_chunk['name']);
             }

Exploit Details

• GitHub: Official vendor fix commit including automated regression test PoC in tests/backend/Feature/UploadAuthorizationTest.php

Mitigation Strategies

• Upgrade FileGator to version 7.15.0 or later to enforce user-prefixed namespaces on reassembled temporary files.
• Deploy Web Application Firewall (WAF) rules to block POST /upload requests containing non-positive values (<= 0) for resumableTotalChunks or resumableTotalSize.
• Restrict the upload permission in FileGator strictly to trusted user accounts.
• Isolate multi-tenant deployments using separate container instances or distinct temporary storage mounts per tenant.

Remediation Steps:

1. Identify all deployed instances of FileGator and check their version numbers in configuration or release metadata.
2. Back up the existing FileGator configuration.php and repository directories.
3. Upgrade FileGator to release v7.15.0 (or apply commit cae442a8323fddae7c8cee0924cdbb1aa6eea702 to backend/Controllers/UploadController.php).
4. Clear stale files in the temporary storage directory (repository/tmp) and verify upload functionality.

References

• GitHub Security Advisory GHSA-44r8-3p76-84mw
• FileGator Official Patch Commit cae442a8323fddae7c8cee0924cdbb1aa6eea702
• FileGator GitHub Pull Request #598
• FileGator Release v7.15.0
• National Vulnerability Database (NVD) - CVE-2026-94619
• CVE.org Record - CVE-2026-94619
• Related FileGator Batch Download Advisory (GHSA-f74m-x83r-c4v4)

Read the full report for CVE-2026-94619 on our website for more details including interactive diagrams and full exploit analysis.