cve.bz

CVE-2026-63358

8.4 highEPSS 0.5%

High (8.4) in filegator filegator. EPSS 0.5% chance of exploitation in the next 30 days.

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Severity

CVSS 4.0

8.4 high
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

7.3 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS
0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE
CWE-732
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON