FileGator Privilege Escalation via Arbitrary chmod

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-63358

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

FileGator has a vulnerability in its '/chmoditems' API endpoint where it accepts arbitrary Unix permission values without validation. These values are passed directly to PHP's chmod() function after conversion via octdec(). This allows an authenticated user with chmod permission to escalate their privileges to root.

Impact Analysis

An attacker with authenticated access and chmod permissions could exploit this to gain root-level access on the server. This could lead to full system compromise, unauthorized data access, or disruption of services.

Mitigation Strategies

Disable or restrict access to the '/chmoditems' API endpoint in FileGator. Ensure only authorized users have chmod permissions. Update FileGator to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-63358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70