FileGator prior 7.15.0 Batch Download DownloadController.php batchDownloadStart uniqid access control

Summaryinfo

A vulnerability identified as critical has been detected in FileGator prior 7.15.0. This issue affects the function batchDownloadStart of the file backend/Controllers/DownloadController.php of the component Batch Download. The manipulation of the argument uniqid leads to access control. This vulnerability is documented as CVE-2026-94618. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in FileGator prior 7.15.0. It has been rated as critical. This issue affects the function batchDownloadStart of the file backend/Controllers/DownloadController.php of the component Batch Download. The manipulation of the argument uniqid with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user home directories, a valid user with read, download, and batchdownload permissions who obtains another user's active archive id can cross that boundary and retrieve the victim's batch archive. The archive lifetime and id-acquisition requirement limit exploitation, but a successful replay also deletes the victim's pending archive. This issue is fixed in version 7.15.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-94618 since 09/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/06/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

By approaching the search of inurl:backend/Controllers/DownloadController.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• FileGator

Version

• <7.15.0

Website

• Product: https://github.com/filegator/filegator/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion