This vulnerability affects kodcloud KodExplorer up to version 4.52 in the initInstall function located in /app/controller/systemMember.class.php. An attacker can manipulate the 'path' argument to bypass authorization checks remotely. The vulnerability allows unauthorized access by circumventing intended access controls. The vendor was notified but has not provided any fix or advisory. No official remediation or patch is currently available, and public exploit code exists.

Successful exploitation results in an attacker bypassing authorization mechanisms, potentially gaining unauthorized access to functionality or data within KodExplorer. The impact is limited to the scope of what the initInstall function controls, with a medium severity rating (CVSS 5.1). There is no indication of privilege escalation beyond the authorization bypass or direct system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to vulnerable KodExplorer instances, especially the affected function, and monitor for exploitation attempts. Applying custom access controls or disabling the vulnerable functionality may reduce risk until an official patch is released.