This vulnerability exists in kodcloud KodExplorer up to version 4.52 within the Public Share Handler component, specifically in the share.class.php file's initShareOld function. An attacker can remotely manipulate the path argument to perform path traversal, potentially accessing files outside the intended directory scope. The vulnerability was publicly disclosed on April 19, 2026, with no vendor response or patch available at the time of disclosure. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated remote attacker to perform path traversal via the path argument, potentially accessing unauthorized files on the server. The impact is rated medium with a CVSS score of 6.9, reflecting limited but significant confidentiality, integrity, and availability impacts. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official kodcloud channels for updates. Until a patch is available, consider restricting access to the affected component or implementing network-level controls to limit exposure. Avoid exposing the vulnerable functionality to untrusted networks if possible.