CVE-2026-104081: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in kalcaddle KodExplorer

CVE-2026-104081 is a path traversal vulnerability in KodExplorer prior to version 4.55. The vulnerability arises from insufficient sanitization in the unzip_pre_name() function, which uses a single non-recursive str_replace() pass that can be bypassed with crafted filenames such as "....//". Additionally, the PclZip extract() call in KodArchive.class.php does not use the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, allowing extraction outside intended directories. An authenticated attacker can upload a malicious ZIP archive containing traversal sequences to overwrite arbitrary files, including core JavaScript assets. This can lead to stored XSS, enabling admin account takeover and remote code execution via unrestricted PHP file upload.

An attacker with authentication can exploit this vulnerability to overwrite arbitrary files on the server, including critical JavaScript assets. This enables stored XSS attacks that can compromise administrator accounts. Following account takeover, the attacker can achieve remote code execution by uploading PHP files without restriction. The CVSS 4.0 score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent uploading ZIP archives or untrusted files. Monitor for suspicious file changes and consider disabling ZIP extraction features if possible. Follow vendor advisories closely for updates and apply official patches once released.