KodExplorer CVE-2026-104081

Requires an authenticated low-privileged account (PR:L) on KodExplorer before 4.55 with permission to upload and extract ZIP archives through the unzip feature that invokes unzip_pre_name() in app/function/helper.function.php. The vulnerability is reachable only because PclZip's extract() in KodArchive.class.php omits the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option and the single-pass str_replace() sanitization fails to strip nested '....//' sequences. Limiting factors: valid authentication is mandatory (not remote-unauthenticated), the attacker must use the archive-extraction functionality, and full impact (admin takeover/RCE) additionally depends on an administrator subsequently loading the overwritten JavaScript asset to trigger the stored XSS.

This is a credible, actionable priority rather than an inflated high-CVSS issue, though it is not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only low-privilege authentication (PR:L) and no user interaction, which matches the description's 'authenticated attackers' framing. The vendor scores impact as integrity/availability high with confidentiality none (VC:N/VI:H/VA:H), consistent with an arbitrary-file-overwrite primitive rather than direct data disclosure - though the described kill chain (file overwrite → stored XSS → admin takeover → RCE via PHP upload) ultimately yields full compromise, so the base metrics understate end-state severity. No EPSS score, KEV listing, or POC is present in the input: there is no public exploit identified at time of analysis, and KEV=NO means no confirmed active exploitation. The patch is confirmed available (4.55), and the finding comes from a credible research source (VulnCheck). Net: a reliable, low-complexity post-authentication compromise chain in a self-hosted file manager, worth prompt patching for exposed instances, but without current evidence of mass or active exploitation.

An attacker with a low-privileged authenticated KodExplorer account (versions before 4.55) uploads a malicious ZIP whose entries use crafted traversal sequences like '....//' that survive the single non-recursive str_replace() pass in unzip_pre_name(), and because PclZip's extract() is called without PCLZIP_OPT_EXTRACT_DIR_RESTRICTION, files land outside the intended directory. Overwriting a core JavaScript asset plants stored XSS that executes in an administrator's browser, enabling admin account takeover and subsequent remote code execution through unrestricted PHP file upload. No public exploit is identified at time of analysis, but exploitation requires no user interaction beyond an admin loading the poisoned UI.