| शीर्षक | KodExplorer 4.52 Business Logic Bypass |
|---|
| विवरण | KodExplorer v4.52 contains a pre-authentication business logic bypass in the shared folder upload mechanism. Even when a folder share is configured with uploads disabled through the `canUpload` setting, the backend `share/fileUpload` endpoint does not enforce that restriction. An unauthenticated attacker who knows the share link can therefore upload files directly into the shared directory. This can be abused to inject unwanted content, place phishing files, and tamper with collaborative shared data despite the owner explicitly disabling external uploads. |
|---|
| स्रोत | ⚠️ https://vulnplus-note.wetolink.com/share/PLCI4v0BWaF8 |
|---|
| उपयोगकर्ता | vulnplusbot (UID 96250) |
|---|
| सबमिशन | 26/03/2026 11:17 AM (6 महीनों पहले) |
|---|
| संयम | 18/04/2026 09:07 PM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 358206 [Collabora KodExplorer तक 4.52 fileUpload Endpoint share.class.php अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|