CVE-2026-116056: KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery
A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function requesturlsafe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
KodCloud KodExplorer versions up to and including 4.56 are identified as affected. The issue is in the Remote Download component, specifically the request_url_safe function in app/function/web.function.php.
What access does an attacker need?
The attack can be initiated remotely and requires low privileges, as indicated by the PR:L vector. No user interaction is required.
Is a vendor fix or workaround available?
The available information does not provide a fix or workaround. The vendor was contacted during disclosure but did not respond.
How can I determine whether my instance is exposed?
Verify whether the deployment runs KodExplorer 4.56 or an earlier version and includes the Remote Download functionality. Review use of app/function/web.function.php and its request_url_safe function as the identified affected code path.