CVE-2026-6568 (GCVE-0-2026-6568)

Vulnerability from cvelistv5 – Published: 2026-04-19 09:45 – Updated: 2026-04-19 09:45
VLAI?
Title
kodcloud KodExplorer Public Share share.class.php initShareOld path traversal
Summary
A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CWE
Assigner
References
https://vuldb.com/vuln/358202 vdb-entrytechnical-description
https://vuldb.com/vuln/358202/cti signaturepermissions-required
https://vuldb.com/submit/789981 third-party-advisory
https://vulnplus-note.wetolink.com/share/JyHBnRUaoOY2 broken-linkexploit
Impacted products
Vendor Product Version
kodcloud KodExplorer Affected: 4.0
Affected: 4.1
Affected: 4.2
Affected: 4.3
Affected: 4.4
Affected: 4.5
Affected: 4.6
Affected: 4.7
Affected: 4.8
Affected: 4.9
Affected: 4.10
Affected: 4.11
Affected: 4.12
Affected: 4.13
Affected: 4.14
Affected: 4.15
Affected: 4.16
Affected: 4.17
Affected: 4.18
Affected: 4.19
Affected: 4.20
Affected: 4.21
Affected: 4.22
Affected: 4.23
Affected: 4.24
Affected: 4.25
Affected: 4.26
Affected: 4.27
Affected: 4.28
Affected: 4.29
Affected: 4.30
Affected: 4.31
Affected: 4.32
Affected: 4.33
Affected: 4.34
Affected: 4.35
Affected: 4.36
Affected: 4.37
Affected: 4.38
Affected: 4.39
Affected: 4.40
Affected: 4.41
Affected: 4.42
Affected: 4.43
Affected: 4.44
Affected: 4.45
Affected: 4.46
Affected: 4.47
Affected: 4.48
Affected: 4.49
Affected: 4.50
Affected: 4.51
Affected: 4.52
    cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
vulnplusbot (VulDB User) VulDB CNA Team
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Public Share Handler"
          ],
          "product": "KodExplorer",
          "vendor": "kodcloud",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "status": "affected",
              "version": "4.21"
            },
            {
              "status": "affected",
              "version": "4.22"
            },
            {
              "status": "affected",
              "version": "4.23"
            },
            {
              "status": "affected",
              "version": "4.24"
            },
            {
              "status": "affected",
              "version": "4.25"
            },
            {
              "status": "affected",
              "version": "4.26"
            },
            {
              "status": "affected",
              "version": "4.27"
            },
            {
              "status": "affected",
              "version": "4.28"
            },
            {
              "status": "affected",
              "version": "4.29"
            },
            {
              "status": "affected",
              "version": "4.30"
            },
            {
              "status": "affected",
              "version": "4.31"
            },
            {
              "status": "affected",
              "version": "4.32"
            },
            {
              "status": "affected",
              "version": "4.33"
            },
            {
              "status": "affected",
              "version": "4.34"
            },
            {
              "status": "affected",
              "version": "4.35"
            },
            {
              "status": "affected",
              "version": "4.36"
            },
            {
              "status": "affected",
              "version": "4.37"
            },
            {
              "status": "affected",
              "version": "4.38"
            },
            {
              "status": "affected",
              "version": "4.39"
            },
            {
              "status": "affected",
              "version": "4.40"
            },
            {
              "status": "affected",
              "version": "4.41"
            },
            {
              "status": "affected",
              "version": "4.42"
            },
            {
              "status": "affected",
              "version": "4.43"
            },
            {
              "status": "affected",
              "version": "4.44"
            },
            {
              "status": "affected",
              "version": "4.45"
            },
            {
              "status": "affected",
              "version": "4.46"
            },
            {
              "status": "affected",
              "version": "4.47"
            },
            {
              "status": "affected",
              "version": "4.48"
            },
            {
              "status": "affected",
              "version": "4.49"
            },
            {
              "status": "affected",
              "version": "4.50"
            },
            {
              "status": "affected",
              "version": "4.51"
            },
            {
              "status": "affected",
              "version": "4.52"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vulnplusbot (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-19T09:45:11.131Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-358202 | kodcloud KodExplorer Public Share share.class.php initShareOld path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/358202"
        },
        {
          "name": "VDB-358202 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/358202/cti"
        },
        {
          "name": "Submit #789981 | KodExplorer 4.52 Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/789981"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://vulnplus-note.wetolink.com/share/JyHBnRUaoOY2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-18T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-04-18T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-04-18T21:12:12.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "kodcloud KodExplorer Public Share share.class.php initShareOld path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-6568",
    "datePublished": "2026-04-19T09:45:11.131Z",
    "dateReserved": "2026-04-18T19:06:53.371Z",
    "dateUpdated": "2026-04-19T09:45:11.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-6568",
      "date": "2026-04-19",
      "epss": "0.00088",
      "percentile": "0.2515"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-6568\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-04-19T10:16:09.203\",\"lastModified\":\"2026-04-19T10:16:09.203\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://vuldb.com/submit/789981\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/358202\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/358202/cti\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vulnplus-note.wetolink.com/share/JyHBnRUaoOY2\",\"source\":\"cna@vuldb.com\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…