kcfinder-exposure: KCFinder - Exposure

2026-01-08 KCFinder PoC Public

Description

Detected publicly accessible KCFinder instances that may have allowed arbitrary file uploads and remote code execution (RCE).Exposure of KCFinder could have allowed an attacker to gain unauthorized access to the file manager and upload malicious files.

PoC

id: kcfinder-exposure

info:
  name: KCFinder - Exposure
  author: theamanrawat
  severity: high
  description: |
    Detected publicly accessible KCFinder instances that may have allowed arbitrary file uploads and remote code execution (RCE).Exposure of KCFinder could have allowed an attacker to gain unauthorized access to the file manager and upload malicious files.
  reference:
    - https://github.com/sunhater/kcfinder
  metadata:
    verified: true
    max-request: 6
  tags: exposure,kcfinder,file-upload,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/kcfinder/browse.php"
      - "{{BaseURL}}/assets/kcfinder/browse.php"
      - "{{BaseURL}}/lib/kcfinder/browse.php"
      - "{{BaseURL}}/admin/kcfinder/browse.php"
      - "{{BaseURL}}/includes/kcfinder/browse.php"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<title>KCFinder:"
          - "id=\"files\""
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100fba4c44a3af5f1cd45d7767b57df52ace0db3c500a204ca479079d2055be110c0220339aeb4f630f81648baed16283bf325564a73db9760e5ef3d41541b929421ff1:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/files/kcfinder-exposure.yaml

References

Related Vulnerabilities