Threats tagged 'ghsa-44r8-3p76-84mw'

FileGator versions prior to 7.15.0 have a missing authorization vulnerability in the POST /upload endpoint, allowing a user with upload permission to read, append to, and delete temporary files belonging to other users. This occurs because the request-supplied filename is used directly without proper user namespacing or filtering, enabling cross-user access within the shared temporary directory. The vulnerability also allows deletion of login rate-limit lockfiles, potentially bypassing login throttling.