This vulnerability is a path traversal flaw in the Public Share Handler of kodcloud KodExplorer before version 4.52. By manipulating the path argument in share.class.php::initShareOld, an attacker can cause the server to resolve filesystem paths outside the intended directory, potentially reading sensitive files or exposing hidden directories. The flaw can be triggered over the network, meaning a remote attacker can exploit it without authentication.

Affected systems include any deployment of kodcloud KodExplorer with version 4.52 or older. The issue is present in the Public Share feature and specifically targets the initShareOld function located in /app/controller/share.class.php. No specific operating system was mentioned, so the flaw applies to all platforms where KodExplorer is installed.

The CVSS score of 6.9 reflects a moderate risk, allowing remote exploitation with potential for information disclosure. EPSS is not available, but the public disclosure and lack of vendor response suggest the vulnerability may be actively used. Without a KEV listing, the threat is not yet catalogued by CISA, but the remote nature and path traversal severity merit immediate attention. An attacker could exploit this flaw by sending a crafted request containing directory traversal sequences, bypassing intended access controls and reading arbitrary files on the server.