KodExplorer EUVD-2026-109550

Requires an authenticated low-privilege account on KodExplorer (PR:L in the CVSS vector) and use of the Remote Download feature, which passes a user-supplied URL to the request_url_safe function in app/function/web.function.php; the server then fetches that URL, enabling SSRF. Limiting factors: the attacker must first hold valid credentials (not unauthenticated), the Remote Download functionality must be reachable/enabled, and the target must be KodExplorer version 4.56 or earlier. The precise mechanism by which request_url_safe fails to restrict the destination is not described in the available sources.

This is a medium-severity, authenticated server-side request forgery (CWE-918) in KodExplorer's Remote Download component (request_url_safe in app/function/web.function.php). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, score 5.3) indicates network reach with low attack complexity but requires low-level privileges (PR:L) - i.e. an authenticated account - and yields only low impact across confidentiality, integrity and availability. No EPSS score is provided in the input, the CVE is not listed in CISA KEV, and there is no public exploit identified at time of analysis; the only references are VulDB catalog/CTI/submission pages. The signals are internally consistent and point to a real-but-moderate issue rather than an urgent one: the vuln.today decision label is 'this_month' (not act_now or emergency), impacts are rated low, and exploitation needs prior authentication. The main caveat is that all intelligence traces to a single source (VulDB), the vendor did not respond to disclosure (so there is no vendor advisory, fixed version, or independent confirmation), and EPSS is absent - so real-world exploitation probability cannot be quantified. Treat as a scheduled-remediation item, not a drop-everything emergency.

An attacker with a valid low-privileged KodExplorer account (≤4.56) invokes the Remote Download feature, which passes an attacker-controlled URL to request_url_safe, causing the server to issue an HTTP request to an internal or otherwise unreachable host. This can be used to probe internal services, reach cloud metadata endpoints, or pivot to resources behind the firewall. No public exploit is identified at time of analysis, and the specific trigger beyond the named function is not detailed in the available sources.