---
id: CVE-2026-104081
title: >-
  KodExplorer before 4.55 contains a path traversal vulnerability in the
  unzip_pre_name() function within app/function/helper.function.php, where a
  single non-recursive str_replace() sanitization pass can be bypassed using
  crafted filename…
summary: >-
  KodExplorer before 4.55 contains a path traversal vulnerability in the
  unzip_pre_name() function within app/function/helper.function.php, where a
  single non-recursive str_replace() sanitization pass can be bypassed using
  crafted filename…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-22
published: '2026-10-09'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T18:17:01.517'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104081'
references:
  - url: 'https://github.com/kalcaddle/KodExplorer/releases/tag/4.55'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/kodexplorer-path-traversal-via-unzip-pre-name-zip-extraction
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-09T16:02:33.374Z'
---

## Overview

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.