{"id":"CVE-2026-116057","kind":"vulnerability","aliases":["CVE-2026-116057"],"related":[],"title":"KodExplorer: online editor save endpoint allows unrestricted file upload","description":"A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"KodExplorer up to version 4.55 has a flaw in the online editor save endpoint in app/controller/editor.class.php, where the path and filestr arguments are not checked. A remote attacker can use it to upload arbitrary files, and the exploit is public.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-upload","kodexplorer","package","php","self-hosted"],"not_affected_if":["not-running-kodexplorer"],"how_to_check":"- Check the installed KodExplorer version against 4.55 or lower in the application's version file or admin panel\n- Review app/controller/editor.class.php for the save handler if you run KodExplorer from source\n- unknown for other checks, the sources do not say","fix":"- unknown, the sources do not name a fixed version and the vendor did not respond\n- Restrict access to the editor save endpoint at the web server or reverse proxy until a fix is available","status":"open","published_at":"2026-10-25T16:16:50+00:00","first_seen_at":"2026-10-25T16:41:46+00:00","triaged_at":"2026-10-25T16:42:54+00:00","updated_at":"2026-10-25T16:42:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T16:42:54Z","model":"claude-haiku-5-5","output":{"fix":"- unknown, the sources do not name a fixed version and the vendor did not respond\n- Restrict access to the editor save endpoint at the web server or reverse proxy until a fix is available","reach":"internet","title":"KodExplorer: online editor save endpoint allows unrestricted file upload","impact":"high","summary":"KodExplorer up to version 4.55 has a flaw in the online editor save endpoint in app/controller/editor.class.php, where the path and filestr arguments are not checked. A remote attacker can use it to upload arbitrary files, and the exploit is public.","category":"package","nicknames":[],"who_cares":["kodexplorer","self-hosted","php","file-upload"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker uploads arbitrary files to the server, possibly running code","analyst_note":"Confirm the fixed version and whether authentication is required for the editor save endpoint, using the NVD entry and the linked upstream advisory if one exists.","how_to_check":"- Check the installed KodExplorer version against 4.55 or lower in the application's version file or admin panel\n- Review app/controller/editor.class.php for the save handler if you run KodExplorer from source\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["not-running-kodexplorer"],"who_is_affected":"Teams that self-host KodExplorer up to 4.55 and expose its web interface to users or the internet are exposed, since the flaw is reachable remotely through the editor save path. Instances not running KodExplorer, or running a version above 4.55 when one exists, can skip it. The sources do not say whether authentication is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3365,"output_tokens":614,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116057':12A,15A '-2026':11A,14A '4.55':29B,75C 'affect':76C 'allow':6A 'app/controller/editor.class.php':40B,87C 'arbitrari':58B 'argument':46B,99C 'attack':52B,111C 'check':49B 'compon':90C 'contact':128C 'cve':10A,13A 'disclos':117C 'disclosur':132C 'earli':129C 'editor':3A,36B,92C 'endpoint':5A,38B,94C 'exploit':62B,114C 'file':8A,17B,59B,86C 'file-upload':16B 'filestr':45B 'flaw':32B 'found':69C 'function':83C 'host':24B 'kodcloud':71C 'kodexplor':1A,19B,25B,72C 'launch':109C 'lead':101C 'manipul':96C 'may':122C 'onlin':2A,35B,91C 'packag':20B 'path':43B 'path/filestr':100C 'php':21B 'possibl':107C 'public':64B,120C 'remot':51B,112C 'respond':136C 'save':4A,37B,93C 'self':23B 'self-host':22B 'unknown':82C 'unrestrict':7A,103C 'upload':9A,18B,57B,104C 'use':54B,124C 'vendor':126C 'version':28B 'vulner':66C,79C 'way':139C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host KodExplorer up to 4.55 and expose its web interface to users or the internet are exposed, since the flaw is reachable remotely through the editor save path. Instances not running KodExplorer, or running a version above 4.55 when one exists, can skip it. The sources do not say whether authentication is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T16:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116057","severity":null,"published_at":"2026-10-25T16:16:50+00:00","modified_at":"2026-10-25T16:16:50+00:00","first_seen_at":"2026-10-25T16:41:46+00:00","fetched_at":"2026-10-25T16:41:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}