Kodexplorer EUVD-2026-23695

Remote unauthenticated exploitation against default configurations of kodcloud KodExplorer 4.52 and earlier. No special conditions required-the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerability is exploitable over the network with low attack complexity, no authentication, and no user interaction. Exploitation requires only network reachability to the KodExplorer web interface and knowledge of the /app/controller/share.class.php endpoint path. The vulnerability is in core file-sharing functionality, not a non-default feature that requires explicit enablement. Limiting factors: impact scope is rated Low (C:L/I:L/A:L), suggesting the authentication bypass may expose only a subset of files or limited application functionality rather than full administrative access. The exact data exposure depends on how the application implements file access controls beyond the flawed authentication check.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation: network-accessible, low complexity, requiring no authentication or user interaction. However, impact is rated Low across all CIA triad components (C:L/I:L/A:L), suggesting limited scope rather than complete system compromise. Real-world risk depends heavily on what data KodExplorer instances store and the deployment context. The vendor's non-response raises concerns about patch timeline and ongoing support. No EPSS data provided limits probabilistic risk assessment. Absence from CISA KEV and no public POC reference suggests exploitation is not yet widespread, but the technical barrier is minimal given the attack complexity rating. Organizations using KodExplorer for sensitive file storage face moderate immediate risk; those using it for non-sensitive document sharing face lower risk. The 7.3 CVSS score may overstate practical risk given limited impact ratings, but the trivial exploitation path and vendor silence warrant prioritization for environments handling confidential data.

An unauthenticated attacker identifies a KodExplorer instance exposed to the internet, common in small business or personal cloud storage deployments. The attacker crafts HTTP requests to the /app/controller/share.class.php endpoint, manipulating the fileUrl parameter to reference files outside intended access boundaries-potentially configuration files containing credentials, private documents, or application source code. Due to improper authentication in the fileGet function, the application processes the request without validating user permissions, returning file contents directly to the attacker. With Low integrity and availability impact ratings, the attacker may also modify or delete accessible files, though the scope appears limited compared to full system compromise.