ETK-2026-2325Zero's internal tracking ID, independent of the CVE number.
validatedZero produced an exploit or a check.description
The current FileGator Docker image includes PHP 8.3.35, which is affected by reported PHP remote-code-execution vulnerabilities. An attacker may be able to compromise a publicly reachable FileGator deployment using that image; exposure depends on the instance being accessible to untrusted users.
mitigation
Restrict FileGator access to trusted networks or an authenticated access layer until a rebuilt image containing patched PHP is available. Track FileGator image updates and replace the deployment promptly when the project publishes a rebuild with fixed PHP.
outcome
Check only, differential: the check fires on the vulnerable build and is silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-21 13:41Zghsa: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/ETK-2026-2325
{ "etk_id": "ETK-2026-2325", "cve_id": null, "display_id": "ETK-2026-2325", "ghsa_id": "GHSA-c2f4-g7pq-3p3f", "euvd_id": null, "status": "published", "anchor_state": "awaiting_cve", "title": "Remote code execution exposure in FileGator's bundled PHP", "summary": "The current FileGator Docker image includes PHP 8.3.35, which is affected by reported PHP remote-code-execution vulnerabilities. An attacker may be able to compromise a publicly reachable FileGator deployment using that image; exposure depends on the instance being accessible to untrusted users.", "mitigation": "Restrict FileGator access to trusted networks or an authenticated access layer until a rebuilt image containing patched PHP is available. Track FileGator image updates and replace the deployment promptly when the project publishes a rebuild with fixed PHP.", "vendor": "composer", "product": "composer:filegator/filegator", "affected": [ { "affected_notes": [], "affected_ranges": [ "< 7.16.5" ], "ecosystem": "composer", "fixed_versions": [], "package_name": "filegator/filegator", "purl": "pkg:composer/filegator/filegator" } ], "cwes": null, "cvss_score": 9, "cvss_src": "ethiack_provisional", "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": false, "pipeline_minutes": 21.38983955, "t0_at": null, "signals": { "check": { "at": "2026-10-21T14:53:28.905507+00:00", "days": -0.029134204282407407, "is_lower_bound": true, "measured_at": "2026-10-21T15:35:26.123856+00:00", "url": null }, "trigger_signal": { "at": "2026-10-21T13:41:02+00:00", "days": -0.07944561061342592, "is_lower_bound": true, "measured_at": "2026-10-21T15:35:26.123856+00:00", "url": "https://github.com/filegator/filegator/security/advisories/GHSA-c2f4-g7pq-3p3f" } } }
published 2026-10-21 14:31Z
last change 2026-10-21 15:29Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.