CVE-2022-46154

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
kalcaddle	KodExplorer	< 4.50

References

https://github.com/kalcaddle/KodExplorer/commit/1f7072c0e12150686f10ee8cda82c004f04be98cPatch, Third Party Advisory
https://github.com/kalcaddle/KodExplorer/security/advisories/GHSA-6f8p-4w5q-j5j2Third Party Advisory
https://github.com/kalcaddle/KodExplorer/commit/1f7072c0e12150686f10ee8cda82c004f04be98cPatch, Third Party Advisory
https://github.com/kalcaddle/KodExplorer/security/advisories/GHSA-6f8p-4w5q-j5j2Third Party Advisory

Timeline

Published: Dec 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-461556.4Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source packa CVE-2022-461563.3The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for m CVE-2022-461578.8Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows CVE-2022-461584.3PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. User CVE-2022-461594.3Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on th CVE-2022-46169.1The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerabi CVE-2022-461604.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project l CVE-2022-461619.8pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsa CVE-2022-461629.8discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content genera CVE-2022-461637.5Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, pa CVE-2022-461649.8NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a spe CVE-2022-461655.4Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders