---
id: CVE-2026-116056
title: >-
  KodCloud KodExplorer Remote Download web.function.php request_url_safe
  server-side request forgery
summary: >-
  A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the
  function request_url_safe of the file app/function/web.function.php of the
  component Remote Download. This manipulation causes server-side request
  forgery. It is p…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-918
vendor: KodCloud
product: KodExplorer
affected:
  - KodExplorer 4.0
  - KodExplorer 4.1
  - KodExplorer 4.2
  - KodExplorer 4.3
  - KodExplorer 4.4
  - KodExplorer 4.5
  - KodExplorer 4.6
  - KodExplorer 4.7
  - KodExplorer 4.8
  - KodExplorer 4.9
  - KodExplorer 4.10
  - KodExplorer 4.11
  - KodExplorer 4.12
  - KodExplorer 4.13
  - KodExplorer 4.14
  - KodExplorer 4.15
  - KodExplorer 4.16
  - KodExplorer 4.17
  - KodExplorer 4.18
  - KodExplorer 4.19
  - KodExplorer 4.20
  - KodExplorer 4.21
  - KodExplorer 4.22
  - KodExplorer 4.23
  - KodExplorer 4.24
  - KodExplorer 4.25
  - KodExplorer 4.26
  - KodExplorer 4.27
  - KodExplorer 4.28
  - KodExplorer 4.29
  - KodExplorer 4.30
  - KodExplorer 4.31
  - KodExplorer 4.32
  - KodExplorer 4.33
  - KodExplorer 4.34
  - KodExplorer 4.35
  - KodExplorer 4.36
  - KodExplorer 4.37
  - KodExplorer 4.38
  - KodExplorer 4.39
  - KodExplorer 4.40
  - KodExplorer 4.41
  - KodExplorer 4.42
  - KodExplorer 4.43
  - KodExplorer 4.44
  - KodExplorer 4.45
  - KodExplorer 4.46
  - KodExplorer 4.47
  - KodExplorer 4.48
  - KodExplorer 4.49
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T15:15:13.191Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116056'
references:
  - url: 'https://vuldb.com/vuln/426140'
    label: >-
      VDB-426140 | KodCloud KodExplorer Remote Download web.function.php
      request_url_safe server-side request forgery
  - url: 'https://vuldb.com/vuln/426140/cti'
    label: 'VDB-426140 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116056'
    label: CVE-2026-116056 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/997517'
    label: >-
      Submit #997517 | KodCloud KODExplorer Personal v4.45 - v4.54 Server-Side
      Request Forgery (CWE-918) — do NOT use "Memory corru
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.934Z'
---

## Overview

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `KodExplorer 4.0`
- `KodExplorer 4.1`
- `KodExplorer 4.2`
- `KodExplorer 4.3`
- `KodExplorer 4.4`
- `KodExplorer 4.5`
- `KodExplorer 4.6`
- `KodExplorer 4.7`
- `KodExplorer 4.8`
- `KodExplorer 4.9`
- `KodExplorer 4.10`
- `KodExplorer 4.11`
- `KodExplorer 4.12`
- `KodExplorer 4.13`
- `KodExplorer 4.14`
- `KodExplorer 4.15`
- `KodExplorer 4.16`
- `KodExplorer 4.17`
- `KodExplorer 4.18`
- `KodExplorer 4.19`
- `KodExplorer 4.20`
- `KodExplorer 4.21`
- `KodExplorer 4.22`
- `KodExplorer 4.23`
- `KodExplorer 4.24`
- `KodExplorer 4.25`
- `KodExplorer 4.26`
- `KodExplorer 4.27`
- `KodExplorer 4.28`
- `KodExplorer 4.29`
- `KodExplorer 4.30`
- `KodExplorer 4.31`
- `KodExplorer 4.32`
- `KodExplorer 4.33`
- `KodExplorer 4.34`
- `KodExplorer 4.35`
- `KodExplorer 4.36`
- `KodExplorer 4.37`
- `KodExplorer 4.38`
- `KodExplorer 4.39`
- `KodExplorer 4.40`
- `KodExplorer 4.41`
- `KodExplorer 4.42`
- `KodExplorer 4.43`
- `KodExplorer 4.44`
- `KodExplorer 4.45`
- `KodExplorer 4.46`
- `KodExplorer 4.47`
- `KodExplorer 4.48`
- `KodExplorer 4.49`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.