KodExplorer public share handler vulnerable to path traversal

TL;DR — A path traversal bug in KodExplorer's public-share flow can let unauthenticated remote requests traverse attacker-controlled paths; if you expose public share endpoints, prioritize scoping and compensating controls.

What happened

KodExplorer is a web application that includes a public sharing feature. CVE-2026-6568 describes a path traversal issue in the public share handler, specifically share.class.php::initShareOld in app/controller/share.class.php, where manipulating the path argument can trigger traversal.

The CVE record states the attack can be initiated remotely and that an exploit has been publicly disclosed. While the record does not enumerate the exact security impact beyond traversal, path traversal vulnerabilities in public share endpoints are routinely high-risk because they can become a stepping stone to unauthorized access to server-side files and application secrets, especially in self-hosted deployments.

Who is impacted

• Deployments running KodExplorer versions listed as affected in the CVE record (up to 4.52).
• Environments where KodExplorer public share functionality is reachable from untrusted networks (internet-exposed or broadly accessible internal networks).

What to do now

• Follow vendor remediation guidance if/when it becomes available; the CVE record notes the vendor did not respond at disclosure time, and no patched version is listed.
• Inventory where KodExplorer is deployed and confirm whether the public share feature (and related endpoints) is enabled and reachable from untrusted networks.
• Until a vendor fix is available, consider compensating controls to reduce exposure, such as:
  • restricting access to the public share handler at the network layer (VPN, IP allowlisting, reverse proxy access control)
  • adding WAF rules to detect/block traversal sequences in the path parameter
  • disabling or limiting public share functionality where it is not strictly required
• If compromise is suspected, treat server-side secrets potentially reachable from the web app context as exposed and rotate credentials accessible to the service.