CVE-2026-104081 in KodExplorer
Summary
by MITRE • 10/09/2026
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in KodExplorer prior to version 4.55 represents a critical chain of security failures rooted in improper input validation and insufficient archive extraction controls. The core technical flaw resides within the unzip_pre_name function located in app/function/helper.function.php, which is responsible for sanitizing filenames extracted from uploaded archives. This function employs a single pass of str_replace to remove directory traversal sequences such as dot-dot-slash patterns. However, this approach is fundamentally flawed because it does not account for encoding variations or nested escape attempts that can bypass the initial filter. An attacker can craft malicious ZIP files containing filenames with obfuscated path traversal characters like ....// which survive the sanitization process due to the non-recursive nature of the replacement logic. This allows the extracted file paths to contain absolute directory references rather than remaining confined within the intended application root directory.
Compounding this input validation failure is a misconfiguration in the archive extraction mechanism found in KodArchive.class.php. The PclZip library, which handles the actual unpacking of ZIP files, is invoked without enabling the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. This omission means that even if some level of path normalization occurs elsewhere in the codebase, the underlying extraction engine will happily write files to any location on the server filesystem for which the web process has write permissions. The combination of a bypassed input filter and an unrestricted extraction destination creates a classic directory traversal vulnerability that allows arbitrary file overwrites within the application's execution context.
The operational impact of this vulnerability is severe, particularly because it requires authentication but leads to full system compromise through a multi-stage attack vector. An authenticated attacker can upload a specially crafted ZIP archive containing malicious JavaScript files disguised as legitimate assets or placed in directories where they will be served by the web server. By overwriting core JavaScript assets, the attacker injects persistent cross-site scripting payloads into pages viewed by other users, including administrators. This stored XSS capability serves as the pivot point for privilege escalation. Once an administrator's session is hijacked via the injected script, the attacker gains access to administrative functions that allow unrestricted PHP file uploads. Through this secondary upload mechanism, arbitrary code can be executed on the server, resulting in complete remote code execution and loss of confidentiality, integrity, and availability for the affected system.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, which describes how insufficient validation allows access outside intended boundaries. The initial bypass technique relates closely to CWE-184 Incomplete List of Invalid Inputs, as the sanitization logic failed to handle all possible variations of traversal sequences. Furthermore, the exploitation path involving stored XSS and subsequent admin takeover maps directly to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for code execution and T1136 Create Account or T1078 Valid Accounts if new credentials are established during the session hijacking phase. The ability to overwrite web-accessible files also touches upon CWE-436 Interpretation Error, where the system misinterprets user-supplied data as executable content rather than safe text.
Mitigation strategies must address both the immediate code flaws and broader architectural weaknesses. The most effective remediation is upgrading KodExplorer to version 4.55 or later, where these specific issues have been patched by implementing recursive sanitization of path traversal sequences and enforcing strict directory restrictions during archive extraction using PCLZIP_OPT_EXTRACT_DIR_RESTRICTION. For systems that cannot be immediately upgraded, administrators should restrict file upload permissions for the web server user to prevent writing outside designated directories, although this is a less robust defense-in-depth measure. Additionally, implementing Content Security Policy headers can help mitigate the impact of stored XSS by restricting script execution sources, thereby reducing the likelihood of successful admin account takeover even if traversal and overwrite attacks succeed in placing malicious scripts on the filesystem. Regular auditing of uploaded file types and locations using automated tools can also provide early detection of such exploitation attempts before they lead to full compromise.