{"id":"CVE-2026-116056","title":"KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery","summary":"A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is p…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-918"],"vendor":"KodCloud","product":"KodExplorer","affected":["KodExplorer 4.0","KodExplorer 4.1","KodExplorer 4.2","KodExplorer 4.3","KodExplorer 4.4","KodExplorer 4.5","KodExplorer 4.6","KodExplorer 4.7","KodExplorer 4.8","KodExplorer 4.9","KodExplorer 4.10","KodExplorer 4.11","KodExplorer 4.12","KodExplorer 4.13","KodExplorer 4.14","KodExplorer 4.15","KodExplorer 4.16","KodExplorer 4.17","KodExplorer 4.18","KodExplorer 4.19","KodExplorer 4.20","KodExplorer 4.21","KodExplorer 4.22","KodExplorer 4.23","KodExplorer 4.24","KodExplorer 4.25","KodExplorer 4.26","KodExplorer 4.27","KodExplorer 4.28","KodExplorer 4.29","KodExplorer 4.30","KodExplorer 4.31","KodExplorer 4.32","KodExplorer 4.33","KodExplorer 4.34","KodExplorer 4.35","KodExplorer 4.36","KodExplorer 4.37","KodExplorer 4.38","KodExplorer 4.39","KodExplorer 4.40","KodExplorer 4.41","KodExplorer 4.42","KodExplorer 4.43","KodExplorer 4.44","KodExplorer 4.45","KodExplorer 4.46","KodExplorer 4.47","KodExplorer 4.48","KodExplorer 4.49"],"published":"2026-10-25","updated":"2026-10-25","sourceUpdated":"2026-10-25T15:15:13.191Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116056","references":[{"url":"https://vuldb.com/vuln/426140","label":"VDB-426140 | KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery"},{"url":"https://vuldb.com/vuln/426140/cti","label":"VDB-426140 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-116056","label":"CVE-2026-116056 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/997517","label":"Submit #997517 | KodCloud KODExplorer Personal v4.45 - v4.54 Server-Side Request Forgery (CWE-918) — do NOT use \"Memory corru"}],"tags":["cve.org"],"ingestedAt":"2026-10-25T22:08:29.934Z","slug":"CVE-2026-116056","body":"## Overview\n\nA flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.\n\n## Affected\n\n- `KodExplorer 4.0`\n- `KodExplorer 4.1`\n- `KodExplorer 4.2`\n- `KodExplorer 4.3`\n- `KodExplorer 4.4`\n- `KodExplorer 4.5`\n- `KodExplorer 4.6`\n- `KodExplorer 4.7`\n- `KodExplorer 4.8`\n- `KodExplorer 4.9`\n- `KodExplorer 4.10`\n- `KodExplorer 4.11`\n- `KodExplorer 4.12`\n- `KodExplorer 4.13`\n- `KodExplorer 4.14`\n- `KodExplorer 4.15`\n- `KodExplorer 4.16`\n- `KodExplorer 4.17`\n- `KodExplorer 4.18`\n- `KodExplorer 4.19`\n- `KodExplorer 4.20`\n- `KodExplorer 4.21`\n- `KodExplorer 4.22`\n- `KodExplorer 4.23`\n- `KodExplorer 4.24`\n- `KodExplorer 4.25`\n- `KodExplorer 4.26`\n- `KodExplorer 4.27`\n- `KodExplorer 4.28`\n- `KodExplorer 4.29`\n- `KodExplorer 4.30`\n- `KodExplorer 4.31`\n- `KodExplorer 4.32`\n- `KodExplorer 4.33`\n- `KodExplorer 4.34`\n- `KodExplorer 4.35`\n- `KodExplorer 4.36`\n- `KodExplorer 4.37`\n- `KodExplorer 4.38`\n- `KodExplorer 4.39`\n- `KodExplorer 4.40`\n- `KodExplorer 4.41`\n- `KodExplorer 4.42`\n- `KodExplorer 4.43`\n- `KodExplorer 4.44`\n- `KodExplorer 4.45`\n- `KodExplorer 4.46`\n- `KodExplorer 4.47`\n- `KodExplorer 4.48`\n- `KodExplorer 4.49`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}