CVE-2026-116056

MediumCVSS 6.3

Published: 25/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 25/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

30th percentile - higher than 30% of all known CVEs

Summary

A flaw has been found in KodCloud KodExplorer up to 4.56 in the request_url_safe function of app/function/web.function.php within the Remote Download component. Manipulation causes server-side request forgery, and the attack can be initiated remotely. The vendor was contacted but did not respond.

Risk Assessment

An attacker could force the server to make requests to internal resources, risking data exposure and access to internal network services. The lack of a vendor fix increases exposure.

Recommendation

Restrict remote download capability and implement URL validation (block private and local addresses). Monitor outgoing HTTP requests from the server for anomalies.

Other vulnerabilities in KodCloud KodExplorer

CVE-2026-116057Medium
A vulnerability has been found in KodCloud KodExplorer up to 4.55 in an unknown functionality of app/controller/editor.class.php within the Online Editor Save Endpoint component. Manipulation of the path/filestr argument leads to unrestricted upload, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used; the vendor did not respond.

Original NVD description (English source)

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS