Kodexplorer CVE-2026-6572

The fileUpload endpoint must be accessible over the network without authentication (PR:N in CVSS vector confirms no prior authentication required). The /app/controller/share.class.php file must be present and functional in the target KodExplorer installation (expected in standard deployments). Exploitation requires manipulation of the fileUpload parameter, implying the attacker must craft a specific payload format - the exact format is not detailed in the CVE description, but the public POC specifies this. The attack complexity is rated as high (AC:H), indicating there are significant technical barriers: these may include cryptographic requirements, race conditions, or non-default configuration states that narrow real-world exploitability. No user interaction (UI:N) is required from victims. The vulnerability is not known to require special deployment modes, but the lack of vendor response means no officially supported workarounds exist and scope is unconfirmed.

Multiple signals indicate this is a moderate real-world risk, not a critical issue despite network exploitability. The CVSS score of 5.6 with a network attack vector (AV:N) and no privilege requirements (PR:N) initially suggest accessibility, but the high complexity (AC:H) and unconfirmed authentication bypass create friction. The EPSS data is absent, preventing exploitation probability comparison. CVSS environmental metrics show RL:X (unknown remediation level, reflecting vendor non-response) and RC:R (reasonable confidence from public disclosure and POC). Critically, the description explicitly states the exploit is 'known to be difficult' despite public availability - this mismatch suggests the POC may be incomplete, non-functional, or require specific environmental conditions. No CISA KEV listing is provided, so active widespread exploitation is not confirmed. Attack Complexity High (AC:H) is a significant limiting factor; defenders should assess whether the complexity requirement is prohibitive in their environment. The authentication bypass nature (CWE-285) is serious if exploitable, but difficulty of exploitation reduces urgency compared to high-CVSS trivial attacks. Organizations running KodExplorer 4.52 should treat this as a medium-priority patch candidate pending vendor response or alternative mitigation.

An attacker sends a crafted HTTP request to the fileUpload endpoint in /app/controller/share.class.php, manipulating the fileUpload parameter with a specially constructed value that bypasses the endpoint's authorization checks. If successful, the attacker gains unauthorized ability to upload, access, or share files without authentication, potentially exfiltrating sensitive data or modifying server content. The high complexity and reported difficulty suggest the attacker must understand KodExplorer's internal request format and may need to iterate or use the public POC as a template.