Which versions of PHP are affected by CVE-2026-6568?

CVE-2026-6568 is a critical path traversal vulnerability in KodExplorer versions 4.52 and earlier that allows unauthenticated attackers to access unauthorized files through the public share feature,…

Is there a public PoC exploit available for CVE-2026-6568?

Yes, a public proof-of-concept exploit is available for CVE-2026-6568. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-6568?

Within 24 hours: Identify all systems running KodExplorer 4.52 or earlier via network inventory and audit access logs for suspicious path traversal patterns (look for ../ sequences in public share handler requests). Within 7 days: Immediately isolate or air-gap affected KodExplorer instances from production networks, migrate critical file sharing functionality to patched alternatives (consider Nextcloud 28+, Seafile 11+, or other maintained solutions), and preserve forensic logs. Within 30 days: Complete decommission of KodExplorer 4.52 systems or upgrade to version 4.53 or later if released; conduct forensic analysis of access logs dating back 90 days to determine if unauthorized file access occurred.

PHP CVE-2026-6568

Q: What is the CVSS score of CVE-2026-6568?

CVE-2026-6568 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-23694 MEDIUM

Path Traversal (CWE-22)

2026-04-19 VulDB

PHP Path Traversal

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 19, 2026 - 10:22 NVD

HIGH MEDIUM

CVSS changed

Apr 19, 2026 - 10:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 19, 2026 - 10:18 vuln.today

EUVD ID Assigned

Apr 19, 2026 - 10:15 euvd

EUVD-2026-23694

Analysis Generated

Apr 19, 2026 - 10:15 vuln.today

CVE Published

Apr 19, 2026 - 09:45 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in kodcloud KodExplorer 4.52 and earlier allows unauthenticated remote attackers to access unauthorized files via the public share handler's path parameter. The vulnerability has publicly available exploit code (EPSS data not provided, not listed in CISA KEV). The vendor did not respond to responsible disclosure, leaving all versions through 4.52 unpatched at time of analysis.

Technical ContextAI

KodExplorer is a web-based file management system written in PHP. This vulnerability resides in the share.class.php file, specifically the initShareOld function within the Public Share Handler component (/app/controller/share.class.php). The flaw is a classic path traversal (CWE-22) caused by insufficient validation of the 'path' parameter. Attackers can manipulate this parameter with directory traversal sequences (e.g., '../') to escape intended directory restrictions and access files outside the designated share scope. The affected product CPE (cpe:2.3:a:kodcloud:kodexplorer) indicates all versions up to and including 4.52 are vulnerable, as the vendor has not issued any security updates addressing this issue.

RemediationAI

No vendor-released patch is available as kodcloud did not respond to vulnerability disclosure. Organizations running KodExplorer 4.52 or earlier should implement compensating controls immediately: (1) Disable the public share feature entirely if not business-critical by removing or restricting access to /app/controller/share.class.php endpoint at the web server level (trade-off: breaks public file sharing functionality). (2) Implement web application firewall rules to block requests containing directory traversal patterns (../, ..\, URL-encoded variants) in the 'path' parameter targeting share.class.php (trade-off: may cause false positives with legitimate filenames containing these sequences). (3) Restrict KodExplorer access to authenticated users only via network segmentation or reverse proxy authentication (trade-off: eliminates anonymous public sharing capability). (4) Monitor for abnormal file access patterns in application logs, particularly requests to share.class.php with suspicious path values. Detailed exploit analysis available at https://vulnplus-note.wetolink.com/share/JyHBnRUaoOY2. Consider migrating to actively maintained file management solutions given vendor's lack of security response.