Description
A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| KodCloud | KodExplorer | 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, 4.23, 4.24, 4.25, 4.26, 4.27, 4.28, 4.29, 4.30, 4.31, 4.32, 4.33, 4.34, 4.35, 4.36, 4.37, 4.38, 4.39, 4.40, 4.41, 4.42, 4.43, 4.44, 4.45, 4.46, 4.47, 4.48, 4.49, 4.50, 4.5… | — |
References
- VDB-426140 | KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery vdb-entry technical-description
- VDB-426140 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-116056 | CVE Analysis and Report third-party-advisory
- Submit #997517 | KodCloud KODExplorer Personal v4.45 - v4.54 Server-Side Request Forgery (CWE-918) — do NOT use "Memory corru third-party-advisory