High severity · published Apr 19, 2026
CVE-2026-6569
kodcloud KodExplorer fileGet Endpoint share.class.php improper authentication
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the component fileGet Endpoint. Such manipulation of the argument fileUrl leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
KodExplorer · kodcloud
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +34 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6569
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6569
vuldb.com
https://vuldb.com/submit/789982
vuldb.com
https://vuldb.com/vuln/358203
vuldb.com
https://vuldb.com/vuln/358203/cti
vulnplus-note.wetolink.com
https://vulnplus-note.wetolink.com/share/wgfZR6kXRApl
More from KodExplorer
9.8
CVE-2023-6853
kalcaddle KodExplorer app.php index server-side request forgery
9.8
CVE-2023-6852
kalcaddle KodExplorer app.php server-side request forgery
9.8
CVE-2023-6851
kalcaddle KodExplorer ZIP Archive app.php unzipList code injection
9.8
CVE-2023-6850
kalcaddle KodExplorer API Endpoint unrestricted upload
8.8
CVE-2022-4944
kalcaddle KodExplorer cross-site request forgery