Kodexplorer EUVD-2026-23694

The Public Share Handler feature must be enabled and accessible in the KodExplorer installation. Default installations of KodExplorer 4.52 and earlier include this functionality enabled. No authentication is required (PR:N) - the vulnerability affects unauthenticated public share endpoints. Attack complexity is low (AC:L) with no special configuration needed beyond having the share.class.php component accessible over the network. Exploitation is LIMITED by: the scope of files accessible depends on web server process permissions and PHP configuration (open_basedir restrictions if configured), and the specific share implementation may restrict write operations depending on share permissions settings.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated remote exploitation with low attack complexity, yielding a base score of 7.3 (High). The Exploitability metric (E:P) confirms proof-of-concept code exists. However, the impact is limited to partial confidentiality, integrity, and availability (C:L/I:L/A:L) with no scope change (S:U), suggesting attackers can read/modify some files but not achieve full system compromise. Real-world risk is elevated by the public exploit availability and vendor unresponsiveness (RL:X indicates no official fix), but mitigated by the product's limited enterprise deployment and the fact that exploitation targets a specific feature (public share functionality). SSVC assessment: exploitation is proven (POC public), automatable (network-accessible API endpoint), with moderate technical impact (file access, not RCE). Priority should be HIGH for organizations running KodExplorer with public share features enabled, MEDIUM for those with share features disabled or restricted to authenticated users. CRITICAL DATA GAP: No EPSS score provided, preventing statistical exploitation probability assessment. No CISA KEV listing suggests exploitation remains opportunistic rather than widespread.

An unauthenticated attacker identifies a KodExplorer installation with public share functionality exposed. By sending a crafted HTTP request to the share endpoint with a manipulated path parameter containing directory traversal sequences (e.g., path=../../../etc/passwd), the attacker bypasses intended access controls to read sensitive configuration files, application source code, or user data outside the designated share directory. If write operations are also affected, attackers could modify files or upload malicious content. Public proof-of-concept code simplifies exploitation, requiring minimal technical sophistication.