CVE-2026-6568
Full vulnerability record from the local CVENow database.
Description
A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
MEDIUM
CVSS score
5.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-04-19 10:16:09.203000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-6568",
"sourceIdentifier": "[email protected]",
"published": "2026-04-19T10:16:09.203",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "es",
"value": "Se determinó una vulnerabilidad en kodcloud KodExplorer hasta 4.52. Esto afecta a la función share.class.php::initShareOld del archivo /app/controller/share.class.php del componente Gestor de Compartición Pública. Esta manipulación del argumento path causa salto de ruta. El ataque puede iniciarse remotamente. El exploit ha sido divulgado públicamente y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgación, pero no respondió de ninguna manera."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "kodcloud",
"product": "KodExplorer",
"cpes": [
"cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"
],
"modules": [
"Public Share Handler"
],
"versions": [
{
"version": "4.0",
"status": "affected"
},
{
"version": "4.1",
"status": "affected"
},
{
"version": "4.2",
"status": "affected"
},
{
"version": "4.3",
"status": "affected"
},
{
"version": "4.4",
"status": "affected"
},
{
"version": "4.5",
"status": "affected"
},
{
"version": "4.6",
"status": "affected"
},
{
"version": "4.7",
"status": "affected"
},
{
"version": "4.8",
"status": "affected"
},
{
"version": "4.9",
"status": "affected"
},
{
"version": "4.10",
"status": "affected"
},
{
"version": "4.11",
"status": "affected"
},
{
"version": "4.12",
"status": "affected"
},
{
"version": "4.13",
"status": "affected"
},
{
"version": "4.14",
"status": "affected"
},
{
"version": "4.15",
"status": "affected"
},
{
"version": "4.16",
"status": "affected"
},
{
"version": "4.17",
"status": "affected"
},
{
"version": "4.18",
"status": "affected"
},
{
"version": "4.19",
"status": "affected"
},
{
"version": "4.20",
"status": "affected"
},
{
"version": "4.21",
"status": "affected"
},
{
"version": "4.22",
"status": "affected"
},
{
"version": "4.23",
"status": "affected"
},
{
"version": "4.24",
"status": "affected"
},
{
"version": "4.25",
"status": "affected"
},
{
"version": "4.26",
"status": "affected"
},
{
"version": "4.27",
"status": "affected"
},
{
"version": "4.28",
"status": "affected"
},
{
"version": "4.29",
"status": "affected"
},
{
"version": "4.30",
"status": "affected"
},
{
"version": "4.31",
"status": "affected"
},
{
"version": "4.32",
"status": "affected"
},
{
"version": "4.33",
"status": "affected"
},
{
"version": "4.34",
"status": "affected"
},
{
"version": "4.35",
"status": "affected"
},
{
"version": "4.36",
"status": "affected"
},
{
"version": "4.37",
"status": "affected"
},
{
"version": "4.38",
"status": "affected"
},
{
"version": "4.39",
"status": "affected"
},
{
"version": "4.40",
"status": "affected"
},
{
"version": "4.41",
"status": "affected"
},
{
"version": "4.42",
"status": "affected"
},
{
"version": "4.43",
"status": "affected"
},
{
"version": "4.44",
"status": "affected"
},
{
"version": "4.45",
"status": "affected"
},
{
"version": "4.46",
"status": "affected"
},
{
"version": "4.47",
"status": "affected"
},
{
"version": "4.48",
"status": "affected"
},
{
"version": "4.49",
"status": "affected"
},
{
"version": "4.50",
"status": "affected"
},
{
"version": "4.51",
"status": "affected"
},
{
"version": "4.52",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-20T15:19:48.693018Z",
"id": "CVE-2026-6568",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://vuldb.com/submit/789981",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/358202",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/358202/cti",
"source": "[email protected]"
},
{
"url": "https://vulnplus-note.wetolink.com/share/JyHBnRUaoOY2",
"source": "[email protected]"
}
]
}