# CVE-2026-116056: KodCloud KodExplorer server-side request forgery in remote download

Source: https://junglewise.ai/threats/cve-2026-116056-a-flaw-has-been-found-in-kodcloud-kodexplorer-up-to-4-56  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116056 · Severity: medium · CVSS 6.3 · Published 2026-10-25

KodExplorer is a web-based file manager and cloud storage application. A flaw in its remote download functionality allows an attacker to make the server perform requests to arbitrary internal or external systems, potentially exposing internal services, exfiltrating data, or accessing restricted resources. The vulnerability can be exploited remotely without requiring authentication.

Technologies: [Kodcloud Kodexplorer](https://junglewise.ai/threats/technologies/kodexplorer). Vendors: [Kodcloud](https://junglewise.ai/threats/vendors/kodcloud).

## Quick answers

**Is CVE-2026-116056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116056 being exploited in the wild.

**How severe is CVE-2026-116056?** Medium severity, with a CVSS score of 6.3, published 25 October 2026.

**Which products and versions are affected?** Kodcloud Kodexplorer up to 4.56.

**Is there a fix for CVE-2026-116056?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116056 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116056?** Check whether you run Kodcloud Kodexplorer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) in the request_url_safe function of the app/function/web.function.php file within the remote download component. The flaw permits unauthenticated remote attackers to craft malicious requests that cause the server to initiate connections to attacker-controlled or internal targets, potentially bypassing network access controls.

## Affected products

- KodCloud KodExplorer up to 4.56

## Timeline

- 2026-10-25: disclosed

## References

- [https://vuldb.com/cve/CVE-2026-116056](https://vuldb.com/cve/CVE-2026-116056)
- [https://vuldb.com/submit/997517](https://vuldb.com/submit/997517)

## Related threats

- [KodCloud KodExplorer unrestricted file upload](https://junglewise.ai/threats/cve-2026-116057-a-vulnerability-has-been-found-in-kodcloud-kodexplorer-up-to-4)
- [KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate…](https://junglewise.ai/threats/cve-2025-34504-kodexplorer-4-52-contains-an-open-redirect-vulnerability-in-the)