CVE-2022-46154 Arbitrary file access in KodExplorer

What is CVE-2022-46154?

CVE-2022-46154 is a high-severity vulnerability in kalcaddle KodExplorer, published on 6 Dec 2022.

Official description

Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from requesting arbitrary files from the host OS file system. As a result any files available to the host process may be accessed by arbitrary users. This issue has been addressed in version 4.50. Users are advised to upgrade. There are no known workarounds for this issue.

Weakness: CWE-22

Which versions are affected by CVE-2022-46154?

It affects 1 product.

Products include Kodcloud Kodexplorer.

How do I fix CVE-2022-46154?

No fix has been published for CVE-2022-46154 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-46154 being exploited?

There is no known exploitation of CVE-2022-46154 in the wild and no public exploit code.

Other vulnerabilities in kalcaddle KodExplorer

• CVE-2023-6850 kalcaddle KodExplorer API Endpoint unrestricted upload Medium 6.3
• CVE-2023-6851 kalcaddle KodExplorer ZIP Archive app.php unzipList code injection Medium 6.3
• CVE-2023-6852 kalcaddle KodExplorer app.php server-side request forgery Medium 6.3
• CVE-2023-6853 kalcaddle KodExplorer app.php index server-side request forgery Medium 6.3
• CVE-2023-49489 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6f8p-4w5q-j5j2.