CVE-2026-63358

HIGH

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validat...

Affects 1 product across 1 vendor.

CVSS 3.17.3
CVSS v48.4
EPSS0.5%
Percentile42th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact.
CWE Weakness Definitions
CWE-732: Incorrect Permission Assignment for Critical Resource

Software sets permissions on critical resources allowing unintended actors to read or modify them.

Related Attack Patterns (CAPEC)
CAPEC-60 Reusing Session IDs (aka Session Replay)
via CWE-732
CAPEC-61 Session Fixation
via CWE-732
CAPEC-127 Directory Indexing
via CWE-732
CAPEC-206 Signing Malicious Code
via CWE-732
CAPEC-642 Replace Binaries
via CWE-732
Show all 11

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A high severity vulnerability (CVE-2026-63358) affects the target system. FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' p...

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-63358?
A high severity vulnerability (CVE-2026-63358) affects the target system. FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' p...
What is the CVSS score for CVE-2026-63358?
CVE-2026-63358 has CVSS 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS: 0.5%.
Is CVE-2026-63358 actively exploited?
No confirmed active exploitation of CVE-2026-63358 as of 2026-09-25.
How do I remediate CVE-2026-63358?
Apply vendor patches for CVE-2026-63358. Monitor Filegator advisories.
What systems are affected by CVE-2026-63358?
CVE-2026-63358 affects Filegator Filegator.
Vulnerability Details
CVE IDCVE-2026-63358
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Published2026-07-21
Last Modified2026-08-05
ICS Relevance0%
Weakness (CWE)
Incorrect Permission Assignment for Critical Resource
SourceNVD
Official Description

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

Source: NIST NVD / MITRE CVE Database

Affected Products
VendorProductAffected Versions
Filegator Filegator < 7.14.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 86 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
Related CVEs affecting Filegator
CVE-2022-1850 8.1 Path Traversal in GitHub repository filegator/filegator prior to 7.8.0. CVE-2022-1849 5.4 Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.
View all Filegator CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →