KodExplorer fileGet Auth Bypass — Unauthenticated Remote File Access

Executive Summary

A high-severity authentication bypass vulnerability (CVE-2026-6569) has been identified in KodExplorer (kodcloud), a widely deployed self-hosted web-based file manager and collaborative cloud platform. The flaw affects all releases through version 4.52 and carries a CVSS score of 7.3.

The vulnerability resides in the fileGet function within /app/controller/share.class.php, where manipulation of the fileUrl argument bypasses authentication controls entirely. An unauthenticated remote attacker can exploit this to read arbitrary files accessible by the KodExplorer process — including configuration files, credentials, and user data.

Organizations running KodExplorer 4.52 or earlier should upgrade immediately or restrict public access to the share endpoint pending a vendor patch.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

KodExplorer's fileGet endpoint under the share controller is designed to serve file content to authenticated users with valid share links. The vulnerability is a failure to properly validate authentication state before processing the fileUrl parameter.

An attacker can craft a direct HTTP request to the endpoint with a manipulated fileUrl value — bypassing the expected authentication check — and receive the contents of the targeted file in the server response.

Attack Scenario

1. Attacker identifies a KodExplorer instance exposed to the network
2. Attacker crafts a GET or POST request directly to:
   /app/controller/share.class.php
   with fileUrl pointing to a target file path
3. Server processes fileGet without validating authentication session
4. File contents returned to unauthenticated attacker
5. Attacker may pivot using exposed config files or credentials

Exploitation Conditions

• KodExplorer 4.52 or earlier must be installed
• The share feature / fileGet endpoint must be network-accessible
• No authentication or special privileges required by the attacker
• Works from any network with HTTP(S) access to the target

Impact Assessment

Immediate Remediation

Step 1: Upgrade KodExplorer

Update to the latest available release from the official repository:

# Check your current installed version
cat /path/to/kodexplorer/config/version.php
 
# Download and apply the latest release from the vendor
# https://github.com/kalcaddle/KodExplorer

Step 2: Restrict Network Access

If an immediate upgrade is not possible, restrict access to the fileGet endpoint via your web server or firewall:

Nginx — block the share controller:

location ~* /app/controller/share\.class\.php {
    deny all;
    return 403;
}

Apache — block via .htaccess:

<FilesMatch "share\.class\.php">
    Order allow,deny
    Deny from all
</FilesMatch>

Step 3: Audit for Prior Exploitation

# Review web server access logs for requests to the vulnerable endpoint
grep -i "share.class.php" /var/log/nginx/access.log | grep "fileGet"
grep -i "share.class.php" /var/log/apache2/access.log | grep "fileGet"
 
# Look for abnormal fileUrl parameter values indicating path traversal attempts
grep "fileUrl" /var/log/nginx/access.log | grep -E "\.\./|%2e%2e"

Step 4: Rotate Exposed Credentials

If exploitation is suspected or config files were accessible:

# Identify KodExplorer database configuration
cat /path/to/kodexplorer/config/setting_user.php | grep -i "db\|pass\|key"
 
# Rotate any credentials or API keys found in configuration files
# Update database passwords, regenerate application secrets

Detection Indicators

Post-Remediation Checklist

1. Upgrade KodExplorer to the latest available version
2. Block access to the share controller at the web server level if upgrading is delayed
3. Review access logs for requests targeting the fileGet endpoint
4. Rotate all credentials stored in KodExplorer configuration files
5. Notify users if their personal files may have been accessed
6. Enable application-layer authentication (SSO, reverse-proxy auth) in front of KodExplorer
7. Restrict KodExplorer to internal networks only — avoid public internet exposure
8. Monitor for follow-on attacks using credentials that may have been leaked

References

• NVD — CVE-2026-6569
• Red Packet Security — CVE-2026-6569 Alert
• KodExplorer GitHub Repository