FileGator accepts arbitrary Unix permission values through the "/chmoditems" API endpoint and forwards them unchanged to PHP’s native chmod() function using octdec() conversion. Because the input is not validated, an authenticated user who already possesses chmod permission can supply any permission value. When chmod() is invoked with values that grant root access, the attacker’s privileges are escalated to the system root. This vulnerability is a classic example of improperly validated permission data, corresponding to CWE-732.

FileGator is the affected product; specific version information was not provided in the data.

The CVSS score of 8.4 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely to occur broadly, and the vulnerability is not listed in CISA’s KEV catalog. The most probable attack path requires an authenticated session that has chmod capability, typically a user with file management privileges. An attacker must supply a crafted permission value via the API, which is then applied as root without further verification.