---
id: "CVE-2026-116057"
kind: "vulnerability"
aliases: ["CVE-2026-116057"]
title: "KodExplorer: online editor save endpoint allows unrestricted file upload"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["file-upload", "kodexplorer", "package", "php", "self-hosted"]
not_affected_if: ["not-running-kodexplorer"]
published_at: "2026-10-25T16:16:50+00:00"
first_seen_at: "2026-10-25T16:41:46+00:00"
updated_at: "2026-10-25T16:42:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116057", "first_seen_at": "2026-10-25T16:41:46+00:00"}]
---

# KodExplorer: online editor save endpoint allows unrestricted file upload

KodExplorer up to version 4.55 has a flaw in the online editor save endpoint in app/controller/editor.class.php, where the path and filestr arguments are not checked. A remote attacker can use it to upload arbitrary files, and the exploit is public.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed KodExplorer version against 4.55 or lower in the application's version file or admin panel
- Review app/controller/editor.class.php for the save handler if you run KodExplorer from source
- unknown for other checks, the sources do not say

## Fix

- unknown, the sources do not name a fixed version and the vendor did not respond
- Restrict access to the editor save endpoint at the web server or reverse proxy until a fix is available

## Timeline

- 2026-10-25T16:41:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116057

## From the sources

A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_