Server-Side Request Forgery Vulnerability in KodCloud KodExplorer
CVE-2026-116056

5.3MEDIUM

Key Information:

Vendor

Kodcloud

Status
Kodexplorer
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116056?

A vulnerability in KodCloud's KodExplorer, specifically within the request_url_safe function in app/function/web.function.php, enables an attacker to exploit server-side request forgery (SSRF). This flaw allows attackers to initiate remote HTTP requests on behalf of the vulnerable server, potentially exposing sensitive internal resources. Despite being notified, KodCloud has not responded regarding the issue. Users of KodExplorer versions up to 4.56 are advised to be vigilant and consider implementing mitigation strategies to safeguard their systems.

Affected Version(s)

KodExplorer 4.0

KodExplorer 4.1

KodExplorer 4.2

References

https://vuldb.com/vuln/426140
vdb-entrytechnical-description
https://vuldb.com/vuln/426140/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116056
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

xiaochengqingjun (VulDB User)
VulDB CNA Team
.