CVE-2026-116056 PUBLISHED

KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery

Assigner: VulDB
Reserved: 24.10.2026 Published: 25.10.2026 Updated: 25.10.2026

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS Score: 5.3

Product Status

Vendor KodCloud
Product KodExplorer
Versions
  • Version 4.0 is affected
  • Version 4.1 is affected
  • Version 4.2 is affected
  • Version 4.3 is affected
  • Version 4.4 is affected
  • Version 4.5 is affected
  • Version 4.6 is affected
  • Version 4.7 is affected
  • Version 4.8 is affected
  • Version 4.9 is affected
  • Version 4.10 is affected
  • Version 4.11 is affected
  • Version 4.12 is affected
  • Version 4.13 is affected
  • Version 4.14 is affected
  • Version 4.15 is affected
  • Version 4.16 is affected
  • Version 4.17 is affected
  • Version 4.18 is affected
  • Version 4.19 is affected
  • Version 4.20 is affected
  • Version 4.21 is affected
  • Version 4.22 is affected
  • Version 4.23 is affected
  • Version 4.24 is affected
  • Version 4.25 is affected
  • Version 4.26 is affected
  • Version 4.27 is affected
  • Version 4.28 is affected
  • Version 4.29 is affected
  • Version 4.30 is affected
  • Version 4.31 is affected
  • Version 4.32 is affected
  • Version 4.33 is affected
  • Version 4.34 is affected
  • Version 4.35 is affected
  • Version 4.36 is affected
  • Version 4.37 is affected
  • Version 4.38 is affected
  • Version 4.39 is affected
  • Version 4.40 is affected
  • Version 4.41 is affected
  • Version 4.42 is affected
  • Version 4.43 is affected
  • Version 4.44 is affected
  • Version 4.45 is affected
  • Version 4.46 is affected
  • Version 4.47 is affected
  • Version 4.48 is affected
  • Version 4.49 is affected
  • Version 4.50 is affected
  • Version 4.51 is affected
  • Version 4.52 is affected
  • Version 4.53 is affected
  • Version 4.54 is affected
  • Version 4.55 is affected
  • Version 4.56 is affected

Credits

  • xiaochengqingjun (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Server-Side Request Forgery CWE