TI-2026-05759 Aliases CVE-2026-6572 GHSA-3v8q-qmgr-97jh

Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization

LOW 28CWE-266Published 2026-04-19 · Updated 2026-04-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-285.

Summary

A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controller/share.class.php of the component fileUpload Endpoint. The manipulation of the argument fileUpload leads to improper authorization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00323 25th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Collabora	KodExplorer	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8; 4.9; 4.10; 4.11; 4.12; 4.13; 4.14; 4.15; 4.16; 4.17; 4.18; 4.19; 4.20; 4.21; 4.22; 4.23; 4.24; 4.25; 4.26; 4.27; 4.28; 4.29; 4.30; 4.31; 4.32; 4.33; 4.34; 4.35; 4.36; 4.37; 4.38; 4.39; 4.40; 4.41; 4.42; 4.43; 4.44; 4.45; 4.46; 4.47; 4.48; 4.49; 4.50; 4.51; 4.52	—	No fix listed	CNA

KodExplorer VendorCollabora Affected 4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8; 4.9; 4.10; 4.11; 4.12; 4.13; 4.14; 4.15; 4.16; 4.17; 4.18; 4.19; 4.20; 4.21; 4.22; 4.23; 4.24; 4.25; 4.26; 4.27; 4.28; 4.29; 4.30; 4.31; 4.32; 4.33; 4.34; 4.35; 4.36; 4.37; 4.38; 4.39; 4.40; 4.41; 4.42; 4.43; 4.44; 4.45; 4.46; 4.47; 4.48; 4.49; 4.50; 4.51; 4.52 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-6572
2026-10-03 Alias added: GHSA-3v8q-qmgr-97jh

References

Exploit 1

https://vulnplus-note.wetolink.com/share/PLCI4v0BWaF8

TI-2026-73868 Collabora Online Built-in CODE Server allows remote code execution KEVCVSS 4.0CRITICAL 9.2
TI-2026-19024 Collabora Online vulnerable to Authorization Bypass CVSS 3.1MEDIUM 5.3
TI-2021-12412 Unauthenticated attacker could gain access to currently open files CVSS 3.1CRITICAL 9.8
TI-2025-40711 Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy CVSS 4.0HIGH 7.2
TI-2023-16934 Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface CVSS 3.1HIGH 8.7
TI-2025-20570 Collabora Online Vulnerable to Arbitrary File Write CVSS 4.0HIGH 8.3

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences