Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-104081 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CNA: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/kalcaddle/KodExplorer/releases/tag/4.55	[email protected]	Release NotesVendor
https://www.vulncheck.com/advisories/kodexplorer-path-traversal-via-unzip-pre-name-zip-extraction	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
KodExplorer	< 4.55
CPE cpe:2.3:a:kodcloud:kodexplorer:::::::: Remediation Upgrade: 4.55moderate efforthttps://github.com/kalcaddle/KodExplorer/releases/tag/4.55

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 9, 2026	CVE Modified	CISA-ADP
Oct 9, 2026	New CVE Received	[email protected]