CVE-2026-104081

Name of the Vulnerable Software and Affected Versions KodExplorer versions prior to 4.55

Description A path traversal issue exists in the unzip pre name() function within app/function/helper.function.php. The flaw occurs because a single non-recursive str replace() sanitization pass can be bypassed using crafted filenames such as "....//". This is further exacerbated by the extract() call in KodArchive.class.php, which lacks the PCLZIP OPT EXTRACT DIR RESTRICTION option. Authenticated attackers can exploit this by uploading a malicious ZIP archive containing traversal sequences to overwrite arbitrary files, including core JavaScript assets. This can lead to stored Cross-Site Scripting (XSS), allowing for admin account takeover and subsequent remote code execution through unrestricted PHP file upload.

Recommendations Update to version 4.55 or later.