CVE-2026-104081

Summary

KodExplorer's unzip_pre_name() function fails to properly sanitize filenames during ZIP extraction, allowing authenticated attackers to perform path traversal attacks that can overwrite critical system files including JavaScript assets, leading to stored XSS and potential admin takeover.

Exploitability

Exploitation requires authentication and involves uploading a specially crafted ZIP file with traversal sequences like '....//', making it moderately difficult but achievable with user access.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code as the web server user, potentially compromising the entire web application and underlying system through stored XSS and unrestricted PHP uploads.

Detection

Monitor for unusual file modification patterns in web root directories, particularly JavaScript and core application files, and watch for unexpected ZIP upload activities in application logs.

Prioritized remediation

Upgrade to KodExplorer 4.55 or later to address this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.