Threats tagged 'ghsa-f74m-x83r-c4v4'

FileGator versions prior to 7.15.0 have a missing authorization vulnerability in the GET /batchdownload endpoint. This flaw allows a low-privileged user to download another user's batch archive by supplying its unique archive ID, bypassing the per-user home directory boundary in multi-user deployments. The archive ID is generated using a predictable uniqid() function without binding ownership metadata, enabling cross-user file disclosure. The vulnerability is limited to deployments with distinct per-user home directories and requires the attacker to have read, download, and batchdownload permissions. The issue is fixed in version 7.15.0.