Kodexplorer CVE-2026-6570

Exploitation requires the attacker to be an authenticated user with high privileges (PR:H) - specifically, an administrator or user with access to the systemMember controller. The initInstall function must be reachable over the network (AV:N), and no user interaction is required (UI:N). The vulnerability does not depend on non-default configuration; it is present in standard KodExplorer installations up to version 4.52. The limiting factor is the requirement for high-privilege authentication; this prevents remote unauthenticated exploitation but does not prevent lateral movement or privilege escalation within the application by existing privileged accounts. The vulnerability is most exploitable in shared-administration scenarios where multiple administrators exist or where former administrators retain access. Single-administrator deployments are lower-risk but still vulnerable if the administrator account is compromised or if the administrator is malicious.

The risk profile presents a notable discrepancy between the CVSS score and real-world exploitability. While the CVSS 2.7 score is very low, this reflects two critical limiting factors: (1) the attacker requires PR:H (high privilege level - likely administrator or advanced user), and (2) the integrity impact (I:L) is limited. However, several aggravating signals elevate practical risk: The Environmental modifier (E:P) indicates proof-of-concept code exists in the wild, the Reliability (RC:R) rating suggests reproducibility is reasonable, and the attack vector is network-based (AV:N) with low complexity (AC:L). The authorization bypass nature of the vulnerability is particularly concerning for multi-tenant or shared-access deployments where a high-privileged user (e.g., administrator) could bypass controls to access restricted functions or modify system initialization settings. The CVSS score underrepresents risk because it only counts integrity impact, but initialization functions often control critical application state, user creation, or security configuration. The lack of vendor response and public exploit availability means defenders have no patched version to upgrade toward and must implement workarounds. For organizations running KodExplorer with multiple administrators or in shared-user environments, this vulnerability should be treated as a privilege-escalation or lateral-movement risk, not a low-priority issue. Organizations with single-admin deployments or air-gapped instances face lower practical risk but still warrant incident monitoring.

An authenticated administrator with high-privilege credentials logs into KodExplorer and crafts a malicious HTTP request to the initInstall function, manipulating the path parameter to values outside the intended scope (e.g., traversal sequences or unvalidated identifiers). The application fails to re-validate authorization for the manipulated path, allowing the administrator to bypass intended access restrictions and modify system initialization settings, such as user account creation, permission configuration, or feature activation. This could enable the attacker to create unauthorized administrative accounts, disable security features, or alter system metadata. The public exploit code simplifies this attack, reducing the barrier to exploitation for attackers with administrative credentials.