CVE-2026-63358·PHP vulnerability

Affected versions

How to fix this CVE

Update FileGator to version 7.14.2 or later to patch a privilege escalation vulnerability in the chmod API endpoint. The vulnerability stems from insufficient validation of Unix permission parameters before they are passed to PHP's chmod() function. Immediately apply this security update to prevent authenticated attackers from escalating their privileges to root.

sudo dnf update php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /chmoditems HTTP/1.1.*permission[^0-7]|chmod.*[^0-7]{3,4}|octdec.*[a-zA-Z0-9]{5,}

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block or restrict POST requests to /chmoditems API endpoint to only authorized administrators; implement strict input validation requiring permission values to match the regex ^[0-7]{3,4}$ before processing; log all chmod API requests for audit purposes.

How to check if you are affected

1. Step 1: Check installed PHP version with: php -v
2. Step 2: Verify FileGator installation location and version with: grep -r 'VERSION\|version' /path/to/filegator/ | grep -i '7\.14'
3. Step 3: Search web server logs for POST requests to '/chmoditems' API endpoint: grep -i 'chmoditems' /var/log/nginx/access.log or /var/log/apache2/access.log
4. Step 4: After patching, confirm FileGator is updated to 7.14.2+ by checking: cat /path/to/filegator/CHANGELOG.md | head -20 or reviewing the git commit hash in version control

FAQ

Related PHP CVEs

References

• https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18
• https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c
• https://github.com/filegator/filegator/tree/master
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json
• https://www.cve.org/CVERecord?id=CVE-2026-63358