{"id":"CVE-2026-104081","published":"2026-10-09T15:17:06.940","lastModified":"2026-10-09T18:17:01.517","description":"KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like \"....//\", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kalcaddle/KodExplorer/releases/tag/4.55","tags":[]},{"url":"https://www.vulncheck.com/advisories/kodexplorer-path-traversal-via-unzip-pre-name-zip-extraction","tags":[]}],"exploitRefs":[{"url":"https://github.com/kalcaddle/KodExplorer/releases/tag/4.55","tags":[]}],"hasPoc":true,"ai":{"summary":"KodExplorer's unzip_pre_name() function fails to properly sanitize filenames during ZIP extraction, allowing authenticated attackers to perform path traversal attacks that can overwrite critical system files including JavaScript assets, leading to stored XSS and potential admin takeover.","exploitability":"Exploitation requires authentication and involves uploading a specially crafted ZIP file with traversal sequences like '....//', making it moderately difficult but achievable with user access.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code as the web server user, potentially compromising the entire web application and underlying system through stored XSS and unrestricted PHP uploads.","remediation":"Upgrade to KodExplorer 4.55 or later to address this path traversal vulnerability.","detection":"Monitor for unusual file modification patterns in web root directories, particularly JavaScript and core application files, and watch for unexpected ZIP upload activities in application logs.","tags":["path-traversal","xss","file-upload"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:58:45.230Z"}}