Path Traversal in Kalcaddle Kodexplorer
CVE-2026-104081
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/kalcaddle/KodExplorer/releases/tag/4.55 (release-notes, patch)
- www.vulncheck.com/advisories/kodexplorer-path-traversal-via-unzip-pre-name-zip-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-104081?
- CVE-2026-104081 is a high-severity vulnerability in Kalcaddle Kodexplorer, classified under Path Traversal. CVSS score: 8.1/10. Published 2026-10-09.
- How severe is CVE-2026-104081?
- High severity. CVSS v3 base score is 8.1 out of 10.