CVE-2026-116056

MediumCVSS 6.3/10Last modified Oct 25, 2026

Description

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 25, 2026
Last modified
Oct 25, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1160576.3A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file apCVE-2026-1160586.3A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the fileCVE-2026-1160607.3A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/addCVE-2026-1160617.3A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opilCVE-2026-1160627.3A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the fiCVE-2026-1160634.7A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipCVE-2026-1160666.8Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers toCVE-2026-1160678.2Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that letCVE-2026-1160688.8Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenCVE-2026-1160696.5NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server CVE-2026-116077.6Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed wiCVE-2026-1160706.5Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated atta