The vulnerability lies in the GET /batchdownload endpoint of FileGator versions prior to 7.15.0, which uses an archive identifier supplied in the request without verifying that the requesting session created it. As a result, an authenticated user who can obtain a valid archive id that belongs to another user can download that user's files, leading to a confidentiality breach. The exploit additionally removes the victim’s pending archive, potentially disrupting legitimate batch processes. The severity is moderate because the attacker must be authenticated and the window of opportunity is constrained by the short lifetime of the temporary archive.

All FileGator installations running any version earlier than 7.15.0 are affected, particularly those configured for multi‑user deployments with separate home directories, where the cross‑user access can occur when a user can learn or intercept another user’s active archive id.

The CVSS score of 5.4 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, an attacker would perform a simple HTTP GET to /batchdownload with a valid uniqid, which requires knowledge or discovery of another user's archive id – information that can be inferred from directory browsing or by replaying a recent request. Because the archive remains valid only briefly, the exploitation window is limited, though a replay still permits data exfiltration and removal of the victim’s archive.