CVE-2026-63358

Katalog CVE

CVSS 7.3 · High EPSS 0,51%

Kerentanan Incorrect Permission Assignment for Critical Resource pada filegator. Skor CVSS 3.1 7.3 (High) menurut CNA.

Deskripsi (NVD)

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c patch
• https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 release notes
• https://github.com/filegator/filegator/tree/master product
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json vdb entry
• https://www.cve.org/CVERecord?id=CVE-2026-63358 vdb entry