Which versions of PHP are affected by CVE-2026-6569?

KodExplorer versions up to 4.52 contain an authentication bypass in the fileGet endpoint that allows unauthenticated attackers to access and potentially manipulate files without credentials or user…

How to fix or mitigate CVE-2026-6569?

Within 24 hours: Inventory all KodExplorer instances and identify current versions in use; restrict network access to KodExplorer servers via firewall rules to trusted IP ranges only. Within 7 days: Evaluate upgrade feasibility to versions above 4.52 if vendor releases a patched version, or plan migration to alternative file management solutions; implement Web Application Firewall (WAF) rules to block suspicious fileGet requests with manipulated fileUrl parameters. Within 30 days: Complete migration away from affected versions or deploy compensating controls if upgrade is not feasible; conduct audit of file access logs for unauthorized fileGet endpoint activity from version 4.52 and earlier deployments.

PHP CVE-2026-6569

Q: What is the CVSS score of CVE-2026-6569?

CVE-2026-6569 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-23695 MEDIUM

Improper Authentication (CWE-287)

2026-04-19 VulDB

GHSA-9782-qgv6-6p8g

PHP Authentication Bypass

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 19, 2026 - 11:22 NVD

HIGH MEDIUM

CVSS changed

Apr 19, 2026 - 11:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 19, 2026 - 10:36 vuln.today

EUVD ID Assigned

Apr 19, 2026 - 10:30 euvd

EUVD-2026-23695

Analysis Generated

Apr 19, 2026 - 10:30 vuln.today

CVE Published

Apr 19, 2026 - 10:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the component fileGet Endpoint. Such manipulation of the argument fileUrl leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authentication in kodcloud KodExplorer versions up to 4.52 allows unauthenticated remote attackers to bypass access controls via the fileGet endpoint. The vulnerability resides in the fileGet function within /app/controller/share.class.php, exploitable by manipulating the fileUrl parameter. With CVSS 7.3 and network attack vector requiring no privileges or user interaction, this enables unauthorized file access and potential data manipulation. EPSS score unavailable; no CISA KEV listing indicates no confirmed widespread exploitation. Vendor non-responsive to disclosure attempts.

Technical ContextAI

KodExplorer (kodcloud) is a PHP-based web file manager. The vulnerability (CWE-287: Improper Authentication) exists in the share.class.php controller, specifically the fileGet function handling file retrieval operations. The fileUrl parameter lacks proper authentication validation, allowing attackers to craft requests that bypass intended access controls. This is a classic authentication bypass pattern in PHP web applications where user-supplied input directly influences resource access without adequate credential verification. The affected component appears to be the file-sharing functionality, where the application fails to enforce authentication boundaries when processing fileUrl arguments, potentially exposing files meant to be protected or accessible only to authenticated users.

RemediationAI

No vendor-released patch identified at time of analysis despite early disclosure attempts. Given vendor non-responsiveness, organizations should implement compensating controls. Primary mitigation: restrict network access to KodExplorer instances to trusted IP ranges via firewall rules or VPN-only access, reducing the AV:N attack vector to local network scope. Secondary controls: deploy a reverse proxy (nginx, Apache) with strict authentication requirements before the KodExplorer application layer, independent of the application's flawed authentication logic. Review web server access logs for anomalous fileGet requests targeting /app/controller/share.class.php with unusual fileUrl parameters. If file-sharing functionality via the affected endpoint is not required, disable or remove the share.class.php controller at the filesystem level (impact: file-sharing features unavailable). For sensitive deployments, consider migrating to actively maintained file manager alternatives with established security track records. Monitor kodcloud GitHub repository and community channels for community-developed patches, though apply with caution without vendor validation. Trade-offs: network restrictions limit legitimate remote access; disabling share.class.php breaks intended functionality; third-party authentication layers add complexity and potential performance impact.