A flaw in KodExplorer’s initInstall function allows an attacker to manipulate the path argument and bypass authorization checks. The vulnerability can be leveraged remotely, enabling an unauthenticated user to trigger the installation routine with elevated privileges, which may lead to unauthorized configuration changes or the execution of malicious code during the installation process. The weakness is rooted in improper validation of user-controlled input, falling under CWE‑285 (Improper Authorization) and CWE‑639 (Authorization Bypass Through User‑Controlled Key).

The issue affects all installations of kodcloud KodExplorer running version 4.52 or earlier. The vulnerability resides in /app/controller/systemMember.class.php within the initInstall method.

The CVSS base score of 5.1 indicates a moderate severity. Attack code for this flaw has already been released to the public, and it can be exploited remotely without prior authentication. Although an EPSS value is not available, the existence of a publicly available exploit and the vendor’s lack of response suggest a non‑negligible likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog.