- Severity: MEDIUM
- CVE: CVE-2026-94619
- Ecosystems: composer
- Packages: filegator/filegator
## Summary
`POST /upload` uses the request-supplied `resumableFilename` directly as a key into the shared temporary directory, without the character filter it applies to `resumableIdentifier` and without namespacing it per user. A valid user holding the `upload` permission can read any file in that directory into their own home directory, append to it, and delete it.
This reproduces the cross-user batch-archive disclosure of GHSA-f74m-x83r-c4v4 through a different route — it still works with the fix for that advisory (PR #597) applied — and additionally allows deleting the login rate-limit lockfile.
Reported with explicit preconditions and bounded impact, as before: the primitive is confined to the temporary directory, not the whole filesystem.
## Details
– `backend/Controllers/UploadController.php:61` — `$file_name = $request->input(‘resumableFilename’, ‘file’)` is **not** passed through the `preg_replace(‘/[^0-9a-zA-Z_]/’, ”, …)` that line 66 applies to `resumableIdentifier`.
– Line 88 builds `$prefix` namespaced by the sanitized username, but `$file_name` reaches the temporary storage at lines 118, 121 and 125 **without** that prefix.
– Line 115 — `if ($chunks_size >= $total_size)` is entered whenever `resumableTotalSize` is `0`.
– Lines 116-119 — the assembly loop `for ($i = 1; $i
Source: GitHub Security Advisories · 2026-11-09