From 19223196a555a1e2d92fb95d144e0072fd75e57f Mon Sep 17 00:00:00 2001
From: Abdul Moiz <abdul.moiz@eonhealth.com>
Date: Sun, 2 Aug 2026 18:58:35 +0500
Subject: [PATCH] Improve GHSA-9m9p-7p6h-xv99

---
 .../GHSA-9m9p-7p6h-xv99.json                  | 38 +++++++++++++++----
 1 file changed, 31 insertions(+), 7 deletions(-)

diff --git a/advisories/unreviewed/2026/07/GHSA-9m9p-7p6h-xv99/GHSA-9m9p-7p6h-xv99.json b/advisories/unreviewed/2026/07/GHSA-9m9p-7p6h-xv99/GHSA-9m9p-7p6h-xv99.json
index 8a83f5a3a70c..bca8d67230e1 100644
--- a/advisories/unreviewed/2026/07/GHSA-9m9p-7p6h-xv99/GHSA-9m9p-7p6h-xv99.json
+++ b/advisories/unreviewed/2026/07/GHSA-9m9p-7p6h-xv99/GHSA-9m9p-7p6h-xv99.json
@@ -1,23 +1,43 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9m9p-7p6h-xv99",
-  "modified": "2026-07-21T21:32:43Z",
+  "modified": "2026-07-21T21:32:53Z",
   "published": "2026-07-21T21:32:42Z",
   "aliases": [
     "CVE-2026-63358"
   ],
+  "summary": "Improper Chmod Permission Validation in FileGator ≤ 7.14.1 Leads to Privilege Escalation via `/chmoditems`",
   "details": "FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
-    },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "filegator/filegator"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "7.14.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 7.14.1"
+      }
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -31,6 +51,10 @@
       "type": "WEB",
       "url": "https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/filegator/filegator/blob/master/backend/Controllers/FileController.php"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/filegator/filegator/tree/master"