Riskcovery

CVE-2026-116056

KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery

State
Published
Severity
5.3 Medium
Published
Oct 25, 2026
Updated
Oct 26, 2026
Reserved
Oct 24, 2026

Read the record on cve.org

Description

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:XVulDB
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:CVulDB
3.06.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:CVulDB
2.06.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:CVulDB

Weaknesses

  • CWE-918 Server-Side Request Forgery

Affected Products

ProductVersions
KodExplorerKodCloud
  • 4.0Affected
  • 4.1Affected
  • 4.2Affected
  • 4.3Affected
  • 4.4Affected
  • 4.5Affected
  • 4.6Affected
  • 4.7Affected
  • 4.8Affected
  • 4.9Affected
  • 4.10Affected
  • 4.11Affected
  • 4.12Affected
  • 4.13Affected
  • 4.14Affected
  • 4.15Affected
  • 4.16Affected
  • 4.17Affected
  • 4.18Affected
  • 4.19Affected
  • 4.20Affected
  • 4.21Affected
  • 4.22Affected
  • 4.23Affected
  • 4.24Affected
  • and 32 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.