Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization
Published Apr 19, 2026
6.3
MEDIUMCVSS 4.0
EPSS 0.40%
Description
A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controller/share.class.php of the component fileUpload Endpoint. The manipulation of the argument fileUpload leads to improper authorization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
-
Affected
- 4.0
- 4.1
- 4.10
- 4.11
- 4.12
- 4.13
- 4.14
- 4.15
- 4.16
- 4.17
- 4.18
- 4.19
- 4.2
- 4.20
- 4.21
- 4.22
- 4.23
- 4.24
- 4.25
- 4.26
- 4.27
- 4.28
- 4.29
- 4.3
- 4.30
- 4.31
- 4.32
- 4.33
- 4.34
- 4.35
- 4.36
- 4.37
- 4.38
- 4.39
- 4.4
- 4.40
- 4.41
- 4.42
- 4.43
- 4.44
- 4.45
- 4.46
- 4.47
- 4.48
- 4.49
- 4.5
- 4.50
- 4.51
- 4.52
- 4.6
- 4.7
- 4.8
- 4.9
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Collabora | KodExplorer | unknown | Affected
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23702 Advisory
- https://vuldb.com/submit/789988 third-party-advisory
- https://vuldb.com/vuln/358206 vdb-entrytechnical-description
- https://vuldb.com/vuln/358206/cti signaturepermissions-required
- https://vulnplus-note.wetolink.com/share/PLCI4v0BWaF8 broken-linkexploit
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23702 | Advisory | |
| https://vuldb.com/submit/789988 | third-party-advisory | |
| https://vuldb.com/vuln/358206 | vdb-entrytechnical-description | |
| https://vuldb.com/vuln/358206/cti | signaturepermissions-required | |
| https://vulnplus-note.wetolink.com/share/PLCI4v0BWaF8 | broken-linkexploit |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data