CVE-2026-63358: FileGator Privilege Escalation Vulnerability

CVE-2026-63358 Overview

CVE-2026-63358 is a privilege escalation vulnerability in FileGator, an open-source PHP-based file management application. The /chmoditems API endpoint accepts arbitrary Unix permission values from authenticated users and passes them directly to PHP's native chmod() function via octdec() conversion, without any validation. An authenticated user holding the chmod permission can set setuid, setgid, or sticky bits on managed files, enabling privilege escalation to root under specific runtime configurations. The weakness is categorized under [CWE-732] Incorrect Permission Assignment for Critical Resource.

Critical Impact
An authenticated FileGator user with chmod privileges can set arbitrary permission bits, including setuid, and escalate privileges to root on the underlying host.

Affected Products

FileGator (open-source file manager)
FileGator versions prior to 7.14.2 (fix released 2026-05-18)
Deployments exposing the /chmoditems API endpoint to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-63358 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63358

Vulnerability Analysis

FileGator exposes a /chmoditems API endpoint that permits authenticated users with the chmod capability to modify Unix file permissions on server-side objects. The endpoint receives a permission string from the client, passes it through PHP's octdec() to convert an octal representation into an integer, and forwards the result directly to the native chmod() call. No allow-list, range check, or bit mask validation is applied to the incoming value.

Because the raw value reaches chmod() unchanged, an attacker can request permission modes such as 4755 or 6755, which set the setuid or setgid bits. When the FileGator process runs as root, or when writable binaries are later executed with elevated privileges, this yields local privilege escalation to root.

Root Cause

The root cause is missing input validation on a security-sensitive parameter. The application trusts the client-supplied permission string and does not restrict which mode bits an authenticated user is allowed to set. The chmod role in FileGator was intended to alter standard read, write, and execute bits, but the implementation exposes the full mode word including special permission bits.

Attack Vector

The attack requires authenticated local access with the chmod permission assigned to the attacker's account. The adversary submits a crafted request to /chmoditems specifying a target file and a permission value that includes the setuid bit. If the target file is an executable owned by root, the file becomes a setuid-root binary and grants root execution to the authenticated user.

php

// Security patch excerpt from backend/App.php
// Wraps service initialization in exception handling so unhandled errors
// return a generic 500 response instead of leaking internal details.
$container->set(Response::class, $response);
$container->set(StreamedResponse::class, $sresponse);

try {
    foreach ($config->get('services', []) as $key => $service) {
        $container->set($key, $container->get($service['handler']));
        $container->get($key)->init(isset($service['config']) ? $service['config'] : []);
    }
} catch (\Exception $e) {

    if (headers_sent()) {
        throw $e; // re-throw exceptions for PHPUnit
    }

    // unhandled exceptions should be logged to stdout and shown as generic internal server errors
    error_log($e);
    http_response_code(500);
    header('Content-Type: application/json');
    echo json_encode(['error' => 'Internal Server Error']);
    die;
}

$response->send();

$this->container = $container;

Source: GitHub Commit 4a44ed9

Detection Methods for CVE-2026-63358

Indicators of Compromise

HTTP POST requests to the /chmoditems endpoint containing octal permission values with high-order bits set, such as 4755, 6755, or 7777.
Newly created setuid or setgid files under directories managed by FileGator, particularly files owned by the web server or root.
Unexpected changes reported by file integrity monitoring on binaries inside FileGator's configured storage roots.

Detection Strategies

Inspect web server access logs for requests to /chmoditems and correlate authenticated user identity with the requested permission mask.
Deploy a host-based rule that alerts when chmod system calls set the setuid (04000) or setgid (02000) bits on files inside FileGator directories.
Baseline the FileGator installation with a file integrity monitor and alert on permission delta events on any executable file.

Monitoring Recommendations

Forward FileGator application logs and web access logs to a centralized log platform for retention and correlation.
Enable Linux auditd rules for chmod, fchmod, and fchmodat syscalls on paths served by FileGator.
Monitor for post-exploitation behavior such as execution of newly setuid binaries by non-root users.

How to Mitigate CVE-2026-63358

Immediate Actions Required

Upgrade FileGator to version 7.14.2 or later, which contains the fix released on 2026-05-18.
Audit user roles and remove the chmod permission from any account that does not strictly require it.
Run the FileGator PHP process under a dedicated unprivileged service account rather than root.

Patch Information

The fix is published in the FileGator repository. Review the GitHub Changelog for 7.14.2 and the corresponding security commit 4a44ed9. Coordinated disclosure details are available in the CISA CSAF advisory and the CVE-2026-63358 record.

Workarounds

Disable the chmod capability in FileGator role configuration until the upgrade is deployed.
Restrict access to the /chmoditems endpoint at the reverse proxy layer with an allow-list of trusted administrator source addresses.
Mount the storage volume with the nosuid option so that any setuid bits set through FileGator have no effect at execution time.

bash

# Mount FileGator storage with nosuid to neutralize setuid abuse
# /etc/fstab entry
/dev/sdb1  /var/filegator/data  ext4  defaults,nosuid,nodev  0  2

# Remount without unmounting
mount -o remount,nosuid,nodev /var/filegator/data

# Verify
mount | grep filegator