CVE-2026-116057

MediumCVSS 6.3/10Last modified Oct 25, 2026

Description

A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 25, 2026
Last modified: Oct 25, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1160586.3A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file CVE-2026-1160607.3A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/add CVE-2026-1160617.3A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opil CVE-2026-1160627.3A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the fi CVE-2026-1160634.7A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manip CVE-2026-1160666.8Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to CVE-2026-1160678.2Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that let CVE-2026-1160688.8Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other ten CVE-2026-1160696.5NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server CVE-2026-116077.6Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed wi CVE-2026-1160706.5Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated atta CVE-2026-1160715.9rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key i