CVE-2026-6569

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6569", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-18T19:06:56.726Z", "datePublished": "2026-04-19T10:15:11.445Z", "dateUpdated": "2026-04-20T14:55:28.674Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-19T10:15:11.445Z"}, "title": "kodcloud KodExplorer fileGet Endpoint share.class.php improper authentication", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "kodcloud", "product": "KodExplorer", "versions": [{"version": "4.0", "status": "affected"}, {"version": "4.1", "status": "affected"}, {"version": "4.2", "status": "affected"}, {"version": "4.3", "status": "affected"}, {"version": "4.4", "status": "affected"}, {"version": "4.5", "status": "affected"}, {"version": "4.6", "status": "affected"}, {"version": "4.7", "status": "affected"}, {"version": "4.8", "status": "affected"}, {"version": "4.9", "status": "affected"}, {"version": "4.10", "status": "affected"}, {"version": "4.11", "status": "affected"}, {"version": "4.12", "status": "affected"}, {"version": "4.13", "status": "affected"}, {"version": "4.14", "status": "affected"}, {"version": "4.15", "status": "affected"}, {"version": "4.16", "status": "affected"}, {"version": "4.17", "status": "affected"}, {"version": "4.18", "status": "affected"}, {"version": "4.19", "status": "affected"}, {"version": "4.20", "status": "affected"}, {"version": "4.21", "status": "affected"}, {"version": "4.22", "status": "affected"}, {"version": "4.23", "status": "affected"}, {"version": "4.24", "status": "affected"}, {"version": "4.25", "status": "affected"}, {"version": "4.26", "status": "affected"}, {"version": "4.27", "status": "affected"}, {"version": "4.28", "status": "affected"}, {"version": "4.29", "status": "affected"}, {"version": "4.30", "status": "affected"}, {"version": "4.31", "status": "affected"}, {"version": "4.32", "status": "affected"}, {"version": "4.33", "status": "affected"}, {"version": "4.34", "status": "affected"}, {"version": "4.35", "status": "affected"}, {"version": "4.36", "status": "affected"}, {"version": "4.37", "status": "affected"}, {"version": "4.38", "status": "affected"}, {"version": "4.39", "status": "affected"}, {"version": "4.40", "status": "affected"}, {"version": "4.41", "status": "affected"}, {"version": "4.42", "status": "affected"}, {"version": "4.43", "status": "affected"}, {"version": "4.44", "status": "affected"}, {"version": "4.45", "status": "affected"}, {"version": "4.46", "status": "affected"}, {"version": "4.47", "status": "affected"}, {"version": "4.48", "status": "affected"}, {"version": "4.49", "status": "affected"}, {"version": "4.50", "status": "affected"}, {"version": "4.51", "status": "affected"}, {"version": "4.52", "status": "affected"}], "cpes": ["cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"], "modules": ["fileGet Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the component fileGet Endpoint. Such manipulation of the argument fileUrl leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:ND"}}], "timeline": [{"time": "2026-04-18T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-18T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-18T21:12:16.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "vulnplusbot (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/358203", "name": "VDB-358203 | kodcloud KodExplorer fileGet Endpoint share.class.php improper authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358203/cti", "name": "VDB-358203 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/789982", "name": "Submit #789982 | KodExplorer 4.52 SSRF", "tags": ["third-party-advisory"]}, {"url": "https://vulnplus-note.wetolink.com/share/wgfZR6kXRApl", "tags": ["broken-link"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T14:53:09.075200Z", "id": "CVE-2026-6569", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:55:28.674Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6569", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:53:09.075200Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:53:10.667Z"}}], "cna": {"title": "kodcloud KodExplorer fileGet Endpoint share.class.php improper authentication", "credits": [{"lang": "en", "type": "reporter", "value": "vulnplusbot (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:ND"}}], "affected": [{"cpes": ["cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"], "vendor": "kodcloud", "modules": ["fileGet Endpoint"], "product": "KodExplorer", "versions": [{"status": "affected", "version": "4.0"}, {"status": "affected", "version": "4.1"}, {"status": "affected", "version": "4.2"}, {"status": "affected", "version": "4.3"}, {"status": "affected", "version": "4.4"}, {"status": "affected", "version": "4.5"}, {"status": "affected", "version": "4.6"}, {"status": "affected", "version": "4.7"}, {"status": "affected", "version": "4.8"}, {"status": "affected", "version": "4.9"}, {"status": "affected", "version": "4.10"}, {"status": "affected", "version": "4.11"}, {"status": "affected", "version": "4.12"}, {"status": "affected", "version": "4.13"}, {"status": "affected", "version": "4.14"}, {"status": "affected", "version": "4.15"}, {"status": "affected", "version": "4.16"}, {"status": "affected", "version": "4.17"}, {"status": "affected", "version": "4.18"}, {"status": "affected", "version": "4.19"}, {"status": "affected", "version": "4.20"}, {"status": "affected", "version": "4.21"}, {"status": "affected", "version": "4.22"}, {"status": "affected", "version": "4.23"}, {"status": "affected", "version": "4.24"}, {"status": "affected", "version": "4.25"}, {"status": "affected", "version": "4.26"}, {"status": "affected", "version": "4.27"}, {"status": "affected", "version": "4.28"}, {"status": "affected", "version": "4.29"}, {"status": "affected", "version": "4.30"}, {"status": "affected", "version": "4.31"}, {"status": "affected", "version": "4.32"}, {"status": "affected", "version": "4.33"}, {"status": "affected", "version": "4.34"}, {"status": "affected", "version": "4.35"}, {"status": "affected", "version": "4.36"}, {"status": "affected", "version": "4.37"}, {"status": "affected", "version": "4.38"}, {"status": "affected", "version": "4.39"}, {"status": "affected", "version": "4.40"}, {"status": "affected", "version": "4.41"}, {"status": "affected", "version": "4.42"}, {"status": "affected", "version": "4.43"}, {"status": "affected", "version": "4.44"}, {"status": "affected", "version": "4.45"}, {"status": "affected", "version": "4.46"}, {"status": "affected", "version": "4.47"}, {"status": "affected", "version": "4.48"}, {"status": "affected", "version": "4.49"}, {"status": "affected", "version": "4.50"}, {"status": "affected", "version": "4.51"}, {"status": "affected", "version": "4.52"}]}], "timeline": [{"lang": "en", "time": "2026-04-18T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-18T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-18T21:12:16.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/358203", "name": "VDB-358203 | kodcloud KodExplorer fileGet Endpoint share.class.php improper authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358203/cti", "name": "VDB-358203 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/789982", "name": "Submit #789982 | KodExplorer 4.52 SSRF", "tags": ["third-party-advisory"]}, {"url": "https://vulnplus-note.wetolink.com/share/wgfZR6kXRApl", "tags": ["broken-link"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the component fileGet Endpoint. Such manipulation of the argument fileUrl leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-19T10:15:11.445Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6569", "state": "PUBLISHED", "dateUpdated": "2026-04-20T14:55:28.674Z", "dateReserved": "2026-04-18T19:06:56.726Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-19T10:15:11.445Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"], "modules": ["fileGet Endpoint"], "product": "KodExplorer", "vendor": "kodcloud", "versions": [{"status": "affected", "version": "4.0"}, {"status": "affected", "version": "4.1"}, {"status": "affected", "version": "4.2"}, {"status": "affected", "version": "4.3"}, {"status": "affected", "version": "4.4"}, {"status": "affected", "version": "4.5"}, {"status": "affected", "version": "4.6"}, {"status": "affected", "version": "4.7"}, {"status": "affected", "version": "4.8"}, {"status": "affected", "version": "4.9"}, {"status": "affected", "version": "4.10"}, {"status": "affected", "version": "4.11"}, {"status": "affected", "version": "4.12"}, {"status": "affected", "version": "4.13"}, {"status": "affected", "version": "4.14"}, {"status": "affected", "version": "4.15"}, {"status": "affected", "version": "4.16"}, {"status": "affected", "version": "4.17"}, {"status": "affected", "version": "4.18"}, {"status": "affected", "version": "4.19"}, {"status": "affected", "version": "4.20"}, {"status": "affected", "version": "4.21"}, {"status": "affected", "version": "4.22"}, {"status": "affected", "version": "4.23"}, {"status": "affected", "version": "4.24"}, {"status": "affected", "version": "4.25"}, {"status": "affected", "version": "4.26"}, {"status": "affected", "version": "4.27"}, {"status": "affected", "version": "4.28"}, {"status": "affected", "version": "4.29"}, {"status": "affected", "version": "4.30"}, {"status": "affected", "version": "4.31"}, {"status": "affected", "version": "4.32"}, {"status": "affected", "version": "4.33"}, {"status": "affected", "version": "4.34"}, {"status": "affected", "version": "4.35"}, {"status": "affected", "version": "4.36"}, {"status": "affected", "version": "4.37"}, {"status": "affected", "version": "4.38"}, {"status": "affected", "version": "4.39"}, {"status": "affected", "version": "4.40"}, {"status": "affected", "version": "4.41"}, {"status": "affected", "version": "4.42"}, {"status": "affected", "version": "4.43"}, {"status": "affected", "version": "4.44"}, {"status": "affected", "version": "4.45"}, {"status": "affected", "version": "4.46"}, {"status": "affected", "version": "4.47"}, {"status": "affected", "version": "4.48"}, {"status": "affected", "version": "4.49"}, {"status": "affected", "version": "4.50"}, {"status": "affected", "version": "4.51"}, {"status": "affected", "version": "4.52"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the component fileGet Endpoint. Such manipulation of the argument fileUrl leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en kodcloud KodExplorer hasta la versi\u00f3n 4.52. Esto afecta a la funci\u00f3n fileGet del archivo /app/controller/share.class.php del componente fileGet Endpoint. Dicha manipulaci\u00f3n del argumento fileUrl conduce a una autenticaci\u00f3n indebida. El ataque puede ser lanzado remotamente. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-6569", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6569", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T14:53:09.075200Z", "version": "2.0.3"}}]}, "published": "2026-04-19T11:16:14.443", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/789982"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358203"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358203/cti"}, {"source": "cna@vuldb.com", "url": "https://vulnplus-note.wetolink.com/share/wgfZR6kXRApl"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.23"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.24"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.26"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.27"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.28"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.29"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.31"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.32"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.33"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.34"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.35"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.36"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.37"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.38"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.39"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.40"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.41"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.42"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.43"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.44"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.45"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.46"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.47"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.48"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.49"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.50"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.51"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.52"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "KodExplorer", "source": "cna", "vendor": "kodcloud"}, "product": "kodexplorer", "vendor": "kodcloud"}], "analysis": {"en": {"generated_at": "2026-04-19T11:20:21.629278+00:00", "value": {"mitigation_remediation": ["Check for and apply any official KodExplorer update that addresses the fileGet authentication bypass.", "If no update is available, block or restrict external access to the /app/controller/share.class.php endpoint using firewall or reverse\u2011proxy rules.", "Consider disabling the fileGet feature until a fixed version is deployed, or enforce strict authentication at the application layer to prevent unauthorized file access."], "summary": {"action": "Apply Patch", "impact": "Improper authentication allowing unauthorized file access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the kodcloud KodExplorer product, specifically versions up to and including 4.52. Consequently any instance of KodExplorer within this version range susceptible to the fileGet endpoint is impacted.", "description_and_impact": "A flaw in the fileGet function of the KodExplorer component permits manipulation of the fileUrl parameter to bypass authentication checks, enabling an attacker to retrieve files without proper authorization. The weakness is identified as an authentication bypass (CWE\u2011287) and can compromise the confidentiality of sensitive content stored on the affected system.", "risk_and_exploitability": "The CVSS score of 6.9 places the issue in the medium severity range; however the lack of an EPSS score or KEV listing does not diminish the potential for exploitation. The description confirms that the attack can be launched remotely, and the absence of a vendor response suggests no immediate mitigation is in place. Attackers could remotely send crafted requests to the fileGet endpoint to retrieve arbitrary files, thereby potentially exposing internal data and breaching confidentiality. The risk is higher for deployments that expose the endpoint to untrusted networks and where authentication controls are not enforced externally."}}}}, "created": "2026-04-19T11:30:15.672142+00:00", "updated": "2026-04-19T15:45:29.233365+00:00", "vendors": ["kodcloud", "kodcloud$PRODUCT$kodexplorer"]}