{"id":"CVE-2026-116056","kind":"vulnerability","aliases":["CVE-2026-116056"],"related":[],"title":"KodExplorer: Remote Download feature allows server-side request forgery","description":"A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"KodExplorer up to version 4.56 has a flaw in the request_url_safe function used by its Remote Download feature. An attacker can make the server send requests to URLs of their choice, including internal addresses.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kodexplorer","package","php","self-hosted"],"not_affected_if":["remote-download-disabled"],"how_to_check":"- Check the installed KodExplorer version against `4.56` and confirm whether the Remote Download feature is enabled\n- Look at `app/function/web.function.php` for the `request_url_safe` function to see whether it validates destination addresses","fix":null,"status":"open","published_at":"2026-10-25T16:16:49+00:00","first_seen_at":"2026-10-25T16:41:46+00:00","triaged_at":"2026-10-25T16:42:53+00:00","updated_at":"2026-10-25T16:42:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T16:42:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"KodExplorer: Remote Download feature allows server-side request forgery","impact":"medium","summary":"KodExplorer up to version 4.56 has a flaw in the request_url_safe function used by its Remote Download feature. An attacker can make the server send requests to URLs of their choice, including internal addresses.","category":"package","nicknames":[],"who_cares":["kodexplorer","self-hosted","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server can be made to request internal network resources on attacker's behalf","analyst_note":"Find whether a fixed version or vendor patch exists and whether Remote Download requires login; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116056.","how_to_check":"- Check the installed KodExplorer version against `4.56` and confirm whether the Remote Download feature is enabled\n- Look at `app/function/web.function.php` for the `request_url_safe` function to see whether it validates destination addresses","needs_analyst":true,"not_affected_if":["remote-download-disabled"],"who_is_affected":"Self-hosted KodExplorer instances at version 4.56 or earlier that expose the Remote Download feature are affected, since the flaw is reachable remotely. The sources do not say whether authentication is required, so instances without the feature or with other access controls may be lower risk. The vendor has not responded to the disclosure and no fixed version is named in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000608,"input_tokens":3318,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116056':13A,16A '-2026':12A,15A '4.56':27B,69C 'address':58B 'affect':70C 'allow':5A 'app/function/web.function.php':80C 'attack':44B,100C 'caus':88C 'choic':55B 'compon':83C 'contact':105C 'cve':11A,14A 'disclosur':109C 'download':3A,41B,85C 'earli':106C 'featur':4A,42B 'file':79C 'flaw':30B,60C 'forgeri':10A,93C 'found':63C 'function':36B,73C 'host':22B 'includ':56B 'initi':98C 'intern':57B 'kodcloud':65C 'kodexplor':1A,17B,23B,66C 'make':46B 'manipul':87C 'packag':18B 'php':19B 'possibl':96C 'remot':2A,40B,84C,101C 'request':9A,33B,50B,74C,92C 'respond':113C 'safe':35B,76C 'self':21B 'self-host':20B 'send':49B 'server':7A,48B,90C 'server-sid':6A,89C 'side':8A,91C 'url':34B,52B,75C 'use':37B 'vendor':103C 'version':26B 'way':116C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted KodExplorer instances at version 4.56 or earlier that expose the Remote Download feature are affected, since the flaw is reachable remotely. The sources do not say whether authentication is required, so instances without the feature or with other access controls may be lower risk. The vendor has not responded to the disclosure and no fixed version is named in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T16:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116056","severity":null,"published_at":"2026-10-25T16:16:49+00:00","modified_at":"2026-10-25T16:16:49+00:00","first_seen_at":"2026-10-25T16:41:46+00:00","fetched_at":"2026-10-25T16:41:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}