- Severity: MEDIUM
- CVE: CVE-2026-94618
- Ecosystems: composer
- Packages: filegator/filegator
### Summary
`GET /batchdownload` streams a batch ZIP to any requester who supplies its `uniqid`, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user’s batch archive, disclosing files the per-user boundary otherwise protects. Reported with explicit preconditions and bounded impact — not a universal “any user steals any file” issue.
### Details
The archive id is generated with plain `uniqid()` and no ownership metadata is bound to it before streaming.
– `backend/Services/Archiver/Adapters/ZipArchiver.php:44` — `createArchive()` uses plain `uniqid()`.
– `backend/Controllers/DownloadController.php:144-145` — `batchDownloadStart()` reads the tmpfs file by the request-supplied `uniqid` after only a charset `preg_replace()`.
– `backend/Controllers/DownloadController.php:158` — the tmpfs archive is removed only after streaming.
– `backend/Controllers/routes.php:207-226` — both batch endpoints are exposed to normal roles with `read`, `download`, `batchdownload`.
No user id, session id, home directory, or creator check is applied before streaming. The code path is unchanged since commit `3f03a40` (2022-05-31) and is present in the latest release `v7.14.3`.
### PoC
Preconditions: a multi-user deployment with distinct per-user `homedir`s (set per-user in `users.json`, or `private_repos => true` on the WordPress/LDAP adapter). The shi…
Source: GitHub Security Advisories · 2026-11-09