CVE-2026-116057

27th percentile - higher than 27% of all known CVEs

A vulnerability has been found in KodCloud KodExplorer up to 4.55 in an unknown functionality of app/controller/editor.class.php within the Online Editor Save Endpoint component. Manipulation of the path/filestr argument leads to unrestricted upload, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used; the vendor did not respond.

An attacker could upload arbitrary files, including executable scripts, potentially leading to remote code execution and server compromise. Public exploit availability increases the risk of active exploitation.

Restrict access to the editor save endpoint and enforce strict validation of uploaded file types and paths. Monitor logs for unusual uploads and consider disabling the vulnerable component until a fix is released.