KodExplorer Path Traversal: Remote Exploitation Possible

The National Vulnerability Database (NVD) has documented CVE-2026-6568, a high-severity path traversal vulnerability in KodExplorer versions up to 4.52. This flaw resides in the share.class.php::initShareOld function within the /app/controller/share.class.php file, specifically impacting the Public Share Handler component.

Attackers can exploit this vulnerability remotely by manipulating the path argument, potentially leading to unauthorized access to files and directories outside the intended scope. The NVD notes that exploit code for this vulnerability has been publicly disclosed, increasing the immediate risk for unpatched systems. Despite early disclosure attempts, the vendor has not yet provided a response.

This is a critical oversight. A CVSS score of 7.3 (HIGH) underscores the danger, particularly with a vector indicating network-based attacks requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N). Defenders using KodExplorer must prioritize mitigation, as the attacker’s calculus here is low effort, high reward, especially with public exploits available.