This vulnerability permits an attacker to manipulate the path and filestr parameters to upload arbitrary files to the server. The lack of any authentication or file type checks enables the upload of executable or web‑shell files, which the attacker can then invoke to gain code execution privileges. Because the upload endpoint is exposed to the public internet, the attack does not require local or privileged access, thereby making the flaw a significant risk for systems that host untrusted input.

KodCloud KodExplorer versions up to and including 4.55 are affected. The flaw resides in the online editor’s save endpoint, which processes file uploads without validating file type or creating restrictions on the target directory.

The CVSS score of 5.3 indicates medium severity, and the EPSS score is not available, showing no current exploitation evidence in public feeds. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: any user with network access to the editor can trigger the upload, and the exploit has already been disclosed to the public.