Which versions of PHP are affected by CVE-2026-4588?

CVE-2026-4588 is a low-severity vulnerability in A vulnerability (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…

Is there a public PoC exploit available for CVE-2026-4588?

Yes, a public proof-of-concept exploit is available for CVE-2026-4588. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4588?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

PHP CVE-2026-4588

Q: What is the CVSS score of CVE-2026-4588?

CVE-2026-4588 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14427 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-03-23 VulDB

GHSA-ggx8-fr26-x696

PHP Information Disclosure

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.9 (LOW)

Severity Changed

Apr 24, 2026 - 16:37 NVD

LOW MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

3.7 (LOW) 6.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 13:00 euvd

EUVD-2026-14427

Analysis Generated

Mar 23, 2026 - 13:00 vuln.today

CVE Published

Mar 23, 2026 - 12:46 nvd

LOW 3.7

DescriptionCVE.org

A vulnerability was determined in kalcaddle kodbox 1.64. Impacted is the function shareSafeGroup of the file /workspace/source-code/app/controller/explorer/shareOut.class.php of the component Site-level API key Handler. This manipulation of the argument sk causes use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Kalcaddle Kodbox 1.64 contains a cryptographic key hardcoding vulnerability in the Site-level API key Handler component (shareSafeGroup function in shareOut.class.php), where manipulation of the 'sk' parameter exploits the use of a hard-coded cryptographic key. This allows unauthenticated remote attackers to disclose sensitive information with low complexity, though the attack itself requires high complexity execution. A public proof-of-concept is available, and the vendor has not responded to early disclosure.

Technical ContextAI

The vulnerability exists in a PHP-based file management application (Kalcaddle Kodbox) and is rooted in CWE-321: Use of Hard-coded Cryptographic Key. The affected component is the Site-level API key Handler, specifically the shareSafeGroup function located at /workspace/source-code/app/controller/explorer/shareOut.class.php. Rather than deriving or securely managing cryptographic keys at runtime, the application relies on embedded static keys within the source code. When an attacker manipulates the 'sk' (likely 'secret key' or similar parameter) argument passed to this function, they can leverage knowledge of or access to this hard-coded key to forge valid authentication tokens or decrypt protected data. The vulnerability is classified as an information disclosure issue affecting the PHP technology stack used by Kodbox.

RemediationAI

The primary remediation is to upgrade Kodbox to a patched version once available from the vendor; however, given the vendor's lack of response, no official update timeline exists. As an interim measure, implement network-level access controls to restrict direct access to the Kodbox application and its API endpoints to trusted internal networks only, and disable or revoke all Site-level API keys if they are not actively required for operations. Additionally, review audit logs for suspicious API key usage patterns, particularly any attempts to manipulate the 'sk' parameter in shareOut.class.php requests. Consider deploying a Web Application Firewall (WAF) with rules to detect and block manipulation of the 'sk' parameter or unusual API key patterns. Monitor the VulDB submission (https://vuldb.com/?id.352424, https://vuldb.com/?ctiid.352424) and vendor communication channels for security patches. If continued use of Kodbox is necessary, evaluate alternative file-sharing solutions with active security maintenance.