{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116057","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2026-10-24T21:35:47.642Z","datePublished":"2026-10-25T15:30:13.590Z","dateUpdated":"2026-10-29T20:09:16.260Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T15:30:13.590Z"},"title":"KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-434","lang":"en","description":"Unrestricted Upload"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-284","lang":"en","description":"Improper Access Controls"}]}],"affected":[{"vendor":"KodCloud","product":"KodExplorer","versions":[{"version":"4.0","status":"affected"},{"version":"4.1","status":"affected"},{"version":"4.2","status":"affected"},{"version":"4.3","status":"affected"},{"version":"4.4","status":"affected"},{"version":"4.5","status":"affected"},{"version":"4.6","status":"affected"},{"version":"4.7","status":"affected"},{"version":"4.8","status":"affected"},{"version":"4.9","status":"affected"},{"version":"4.10","status":"affected"},{"version":"4.11","status":"affected"},{"version":"4.12","status":"affected"},{"version":"4.13","status":"affected"},{"version":"4.14","status":"affected"},{"version":"4.15","status":"affected"},{"version":"4.16","status":"affected"},{"version":"4.17","status":"affected"},{"version":"4.18","status":"affected"},{"version":"4.19","status":"affected"},{"version":"4.20","status":"affected"},{"version":"4.21","status":"affected"},{"version":"4.22","status":"affected"},{"version":"4.23","status":"affected"},{"version":"4.24","status":"affected"},{"version":"4.25","status":"affected"},{"version":"4.26","status":"affected"},{"version":"4.27","status":"affected"},{"version":"4.28","status":"affected"},{"version":"4.29","status":"affected"},{"version":"4.30","status":"affected"},{"version":"4.31","status":"affected"},{"version":"4.32","status":"affected"},{"version":"4.33","status":"affected"},{"version":"4.34","status":"affected"},{"version":"4.35","status":"affected"},{"version":"4.36","status":"affected"},{"version":"4.37","status":"affected"},{"version":"4.38","status":"affected"},{"version":"4.39","status":"affected"},{"version":"4.40","status":"affected"},{"version":"4.41","status":"affected"},{"version":"4.42","status":"affected"},{"version":"4.43","status":"affected"},{"version":"4.44","status":"affected"},{"version":"4.45","status":"affected"},{"version":"4.46","status":"affected"},{"version":"4.47","status":"affected"},{"version":"4.48","status":"affected"},{"version":"4.49","status":"affected"},{"version":"4.50","status":"affected"},{"version":"4.51","status":"affected"},{"version":"4.52","status":"affected"},{"version":"4.53","status":"affected"},{"version":"4.54","status":"affected"},{"version":"4.55","status":"affected"}],"cpes":["cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"],"modules":["Online Editor Save Endpoint"]}],"descriptions":[{"lang":"en","value":"A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}],"timeline":[{"time":"2026-10-24T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-10-24T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-10-24T23:40:57.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"xiaochengqingjun (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"references":[{"url":"https://vuldb.com/vuln/426141","name":"VDB-426141 | KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/426141/cti","name":"VDB-426141 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-116057","name":"CVE-2026-116057 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/997520","name":"Submit #997520 | KodCloud KodExplorer (KODExplorer) v4.31 - v4.54 Remote Code Execution (CWE-434 Arbitrary File Upload / Write)","tags":["third-party-advisory"]}],"x_generator":["VulDB PVTS v202610"]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-29T20:09:07.670424Z","id":"CVE-2026-116057","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-29T20:09:16.260Z"}}]}}