Is CVE-2026-116057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116057 being exploited in the wild.

How severe is CVE-2026-116057?

Medium severity, with a CVSS score of 6.3, published 25 October 2026.

Which products and versions are affected?

Kodcloud Kodexplorer up to 4.55.

Is there a fix for CVE-2026-116057?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-116057 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116057?

Check whether you run Kodcloud Kodexplorer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116057: KodCloud KodExplorer unrestricted file upload

CVE-2026-116057 · Severity: medium · CVSS 6.3 · Published 2026-10-25

KodExplorer is a web-based file manager that allows users to store and manage files online. A flaw in the Online Editor Save endpoint allows attackers to upload files without proper restrictions, potentially enabling them to store malicious content or gain unauthorized access to the system. The vulnerability can be exploited remotely and does not require authentication.

Technologies: Kodcloud Kodexplorer. Vendors: Kodcloud.

Quick answers

Is CVE-2026-116057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116057 being exploited in the wild.
How severe is CVE-2026-116057?: Medium severity, with a CVSS score of 6.3, published 25 October 2026.
Which products and versions are affected?: Kodcloud Kodexplorer up to 4.55.
Is there a fix for CVE-2026-116057?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116057 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116057?: Check whether you run Kodcloud Kodexplorer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Online Editor Save endpoint in app/controller/editor.class.php fails to properly validate the path and filestr parameters, allowing unrestricted file uploads. An attacker can send a crafted request to the endpoint to upload arbitrary files to the system. No authentication is required and the attack vector is network-based.

Affected products

KodCloud KodExplorer up to 4.55

Timeline

2026-10-25: disclosed: Exploit disclosed publicly; vendor non-responsive

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.