CVE-2026-94618— FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

Quick assessment

Affected

filegator filegator

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FileGator 是一款支持多用户的文件管理器。在 7.15.0 版本之前，中的接口会调用函数，以流式传输由请求中提供的所指定的共享临时归档文件，但并未验证该归档是否由当前会话创建。在采用“每个用户拥有独立主目录”的部署环境中，任何拥有读取、下载和批量下载权限的有效用户，若能获取到其他用户正在使用的归档 ID，即可突破用户隔离边界，窃取受害者的批量归档文件。尽管归档的存活时间以及获取 ID 的条件限制了该漏洞的利用难度，但一旦攻击成功，不仅会泄露数据，还会删除受害者待处理的归档文件。该问题已在 7.15.

CVSS 5.4 · Medium EPSS 0.19% · P9 Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1548 · Abuse Elevation Control Mechanism T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
filegator	filegator	`< 7.15.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

Source: CVE Program / CVE List V5

Vulnerability Description

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

使用不充分的随机数

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
filegator	filegator	< 7.15.0	-

II. Public POCs for CVE-2026-94618

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-94618

请登录查看更多情报信息。

Other References for CVE-2026-94618 (4)

https://github.com/filegator/filegator/pull/597 x_refsource_MISC
https://github.com/filegator/filegator/releases/tag/v7.15.0 x_refsource_MISC
https://github.com/filegator/filegator/security/advisories/GHSA-f74m-x83r-c4v4 x_refsource_CONFIRM
https://github.com/filegator/filegator/commit/638737e560cbf20cbeb5da4e4e6c974f8a080531 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-94618

IV. Related Vulnerabilities

Same product: filegator

Same vendor: filegator

Same weakness: CWE-330