This vulnerability affects the fileGet endpoint in kodcloud KodExplorer versions 4.0 through 4.52. An attacker can manipulate the fileUrl parameter in the /app/controller/share.class.php fileGet function to bypass authentication mechanisms improperly. This allows unauthorized remote access to functionality that should be protected. The CVSS 4.0 base score is 6.9, reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No vendor advisory or patch has been published, and the vendor did not respond to early disclosure attempts.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication controls on the fileGet endpoint, potentially gaining unauthorized access to files or functionality within KodExplorer. The impact is rated medium based on the CVSS score of 6.9, indicating limited but significant unauthorized access risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should consider restricting access to the affected endpoint through network controls or other compensating measures until an official fix is released.