Live › vulnerability › CVE-2026-116056
Go to dashboardKodExplorer up to version 4.56 has a flaw in the request_url_safe function used by its Remote Download feature. An attacker can make the server send requests to URLs of their choice, including internal addresses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 16:41 UTC. All times on this page are UTC.
Self-hosted KodExplorer instances at version 4.56 or earlier that expose the Remote Download feature are affected, since the flaw is reachable remotely. The sources do not say whether authentication is required, so instances without the feature or with other access controls may be lower risk. The vendor has not responded to the disclosure and no fixed version is named in the sources.
No product ranges from the sources yet.
4.56 and confirm whether the Remote Download feature is enabledapp/function/web.function.php for the request_url_safe function to see whether it validates destination addressesUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116056")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.