CVE-2026-6570
Last modified
CVE-2026-6570 is a low-severity vulnerability rated 2.7/10 on the CVSS scale. A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php. Performing a manipulation of the argument path results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-6570?
How severe is CVE-2026-6570?
How do I fix CVE-2026-6570?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-65694Microweber CMS through 2.0.20 contains a path traversal vuln…8.7
- CVE-2026-65695Office-Word-MCP-Server through 1.1.11 contains a path traver…7.6
- CVE-2026-65696Overseerr through 1.35.0 contains an authorization bypass th…5.4
- CVE-2026-65697Fathom Lite through 1.3.1 contains a stored cross-site scrip…6.1
- CVE-2026-65698Void through 1.3.4 contains a path traversal vulnerability i…6
- CVE-2026-65699AgentGPT through 1.0.0 contains an authorization bypass thro…4.2
- CVE-2026-65700h2oGPT through 0.2.1 contains a path traversal vulnerability…9.8
- CVE-2026-65701SoftVC VITS Singing Voice Conversion through commit 730930d …9.3
- CVE-2026-65702Vanna through 2.0.2 contains a path traversal vulnerability …8.6
- CVE-2026-65703FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds w…8.5
- CVE-2026-65704FFmpeg through 8.1.2 contains an out-of-bounds write vulnera…7.8
- CVE-2026-65705FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds w…7.8
Are you affected by CVE-2026-6570?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST