Read the docs
TI-2026-70047 Aliases CVE-2026-104081

Path traversal in KodExplorer ZIP extraction lets attackers overwrite files

Priority LOW 35CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

KodExplorer before 4.55 contains a path traversal flaw (CWE-22) in the unzip_pre_name() function, where a single non-recursive str_replace() sanitization pass can be bypassed with crafted filenames such as "....//". The PclZip extract() call in KodArchive.class.php also lacks the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. An authenticated attacker can upload a malicious ZIP archive to overwrite arbitrary files, such as core JavaScript assets, which enables stored XSS that can lead to admin account takeover and remote code execution through unrestricted PHP file upload.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00767 55th percentileScored 2026-11-07
Fix Fixed KodExplorer (kalcaddle): 4.55

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kalcaddleKodExplorerbefore 4.554.55Patch availableCNA
  • KodExplorer Vendorkalcaddle Affected before 4.55 Fixed in 4.55 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*——kalcaddle
  • cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:* Versions — — ·kalcaddle

Remediation

Upgrade KodExplorer to version 4.55 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA KodExplorer (kalcaddle) Fixed in 4.55

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-104081

References

Patch 1

  • TI-2023-06258 kalcaddle KodExplorer app.php index server-side request forgery CVSS 3.1CRITICAL 9.8
  • TI-2026-15344 kalcaddle kodbox msgWarning Plugin action improper authorization CVSS 4.0MEDIUM 6.9
  • TI-2024-34218 An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive… CVSS 3.1MEDIUM 5.3
  • TI-2026-04926 kalcaddle kodbox shareMake/shareCheck server-side request forgery CVSS 4.0MEDIUM 6.3
  • TI-2026-03996 kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication CVSS 4.0MEDIUM 6.3
  • TI-2023-27035 Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows… CVSS 3.1MEDIUM 6.1
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences