CVE-2026-6570
kodcloud KodExplorer systemMember.class.php initInstall authorization
CVSS Score
2.7
EPSS Score
0.0%
EPSS Percentile
0th
A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php. Performing a manipulation of the argument path results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-639 CWE-285 |
| Vendor | kodcloud |
| Product | kodexplorer |
| Published | Apr 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for kodcloud kodexplorer
Be the first to know when new low vulnerabilities affecting kodcloud kodexplorer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
kodcloud / KodExplorer
4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10 4.11 4.12 4.13 4.14 4.15 4.16 4.17 4.18 4.19 4.20 4.21 4.22 4.23 4.24 4.25 4.26 4.27 4.28 4.29 4.30 4.31 4.32 4.33 4.34 4.35 4.36 4.37 4.38 4.39 4.40 4.41 4.42 4.43 4.44 4.45 4.46 4.47 4.48 4.49 4.50 4.51 4.52
References
Credits
🔍 vulnplusbot (VulDB User) VulDB CNA Team