FileGator is a multi‑user file manager that allows users to upload files via a POST request to /upload. Before version 7.15.0 the backend uses the client supplied resumableFilename as a key in shared temporary storage without checking the authorisation of the caller. A user with upload permission can set resumableTotalChunks and resumableTotalSize to zero, causing the assembly loop to write no data, after which the handler reads an existing temporary file of the same name. The file is then stored in that user’s home directory and removed from the temporary location. If the attacker submits the same filename with further chunks, the temporary file can be appended, overwritten, or deleted. This flaw lets a low‑privileged user read, modify, or delete another user’s transient object, including pending archives or login‑rate‑limit lock files. The exposure is limited to the temporary directory, but it still enables cross‑user access to sensitive interim data.

Any deployment of FileGator using versions earlier than 7.15.0 in a multi‑user configuration where users are assigned distinct home directories and have upload permissions is affected. The vulnerability is present in the filegator:filegator product across all platforms that run the vulnerable code path.

The CVSS score of 5.9 indicates a moderate severity. An attacker only needs to be authenticated to upload files, which is a low‑privileged requirement; the flaw exploits lack of per‑user isolation in temporary storage. No exploit code is required, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is a standard HTTP POST request, the vulnerability can be exercised remotely against a web server exposed to the Internet or an internal network without additional elevation. The potential impact is limited to temporary files, but these can contain logs, locks, or partial archives that compromise data integrity or availability for affected users.