Tag: composer

• Severity: MEDIUM
• CVE: CVE-2026-94619
• Ecosystems: composer
• Packages: filegator/filegator

## Summary

`POST /upload` uses the request-supplied `resumableFilename` directly as a key into the shared temporary directory, without the character filter it applies to `resumableIdentifier` and without namespacing it per user. A valid user holding the `upload` permission can read any file in that directory into their own home directory, append to it, and delete it.

This reproduces the cross-user batch-archive disclosure of GHSA-f74m-x83r-c4v4 through a different route — it still works with the fix for that advisory (PR #597) applied — and additionally allows deleting the login rate-limit lockfile.

Reported with explicit preconditions and bounded impact, as before: the primitive is confined to the temporary directory, not the whole filesystem.

## Details

– `backend/Controllers/UploadController.php:61` — `$file_name = $request->input(‘resumableFilename’, ‘file’)` is **not** passed through the `preg_replace(‘/[^0-9a-zA-Z_]/’, ”, …)` that line 66 applies to `resumableIdentifier`.
– Line 88 builds `$prefix` namespaced by the sanitized username, but `$file_name` reaches the temporary storage at lines 118, 121 and 125 **without** that prefix.
– Line 115 — `if ($chunks_size >= $total_size)` is entered whenever `resumableTotalSize` is `0`.
– Lines 116-119 — the assembly loop `for ($i = 1; $i

Source: GitHub Security Advisories · 2026-11-09

• Severity: MEDIUM
• CVE: CVE-2026-94618
• Ecosystems: composer
• Packages: filegator/filegator

### Summary
`GET /batchdownload` streams a batch ZIP to any requester who supplies its `uniqid`, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user’s batch archive, disclosing files the per-user boundary otherwise protects. Reported with explicit preconditions and bounded impact — not a universal “any user steals any file” issue.

### Details
The archive id is generated with plain `uniqid()` and no ownership metadata is bound to it before streaming.

– `backend/Services/Archiver/Adapters/ZipArchiver.php:44` — `createArchive()` uses plain `uniqid()`.
– `backend/Controllers/DownloadController.php:144-145` — `batchDownloadStart()` reads the tmpfs file by the request-supplied `uniqid` after only a charset `preg_replace()`.
– `backend/Controllers/DownloadController.php:158` — the tmpfs archive is removed only after streaming.
– `backend/Controllers/routes.php:207-226` — both batch endpoints are exposed to normal roles with `read`, `download`, `batchdownload`.

No user id, session id, home directory, or creator check is applied before streaming. The code path is unchanged since commit `3f03a40` (2022-05-31) and is present in the latest release `v7.14.3`.

### PoC
Preconditions: a multi-user deployment with distinct per-user `homedir`s (set per-user in `users.json`, or `private_repos => true` on the WordPress/LDAP adapter). The shi…

Source: GitHub Security Advisories · 2026-11-09