KodExplorer EUVD-2026-109551

Requires an authenticated low-privileged account on KodExplorer (PR:L) that can reach the Online Editor Save endpoint in app/controller/editor.class.php; the attacker manipulates the path and filestr arguments to perform an unrestricted file write/upload. Exploitation is remote and needs no user interaction (AV:N, UI:N). Affects KodExplorer versions up to and including 4.55. The primary limiting factor is the authentication requirement - anonymous/unauthenticated users cannot trigger it per the CVSS vector; no non-default configuration is noted as required in the available sources.

This is a moderate, not emergency-grade, issue based on the available signals. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates remote, low-complexity exploitation but requires authentication (PR:L), and the vendor-assigned impacts are all Low (VC:L/VI:L/VA:L), yielding a base score of 5.3. Exploit maturity is E:P (Proof-of-Concept), and the record states the exploit has been publicly disclosed. The vuln.today decision label is 'this_month' rather than act_now/emergency. This vulnerability is NOT in CISA KEV, and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified. There is a notable tension worth flagging: CWE-434 (unrestricted file upload) in a web-based file manager frequently escalates to remote code execution via webshell, which would justify far higher integrity/confidentiality impact than the Low ratings assigned here - the available sources do not describe the precise trigger or confirm whether arbitrary executable (e.g. PHP) content can be written, so the true impact may be understated and should be verified. The only intelligence source is VulDB (single-sourced), and the vendor did not respond to disclosure, so no patched version is confirmed. Net: a credible, authenticated remote upload flaw that is realistically exploitable but currently single-sourced and not evidenced as mass-exploited.

An attacker holding a valid low-privileged KodExplorer account sends a crafted request to the Online Editor Save endpoint (app/controller/editor.class.php), manipulating the path/filestr parameters to write a file outside the intended restrictions. A public PoC reference exists (exploit maturity E:P) but is not verified as working exploit code; the low complexity and network vector make the request itself straightforward to issue once authenticated.