Kodbox CVE-2026-4588

Despite a moderate CVSS 3.7 score, the real-world risk profile is constrained by several factors. The CVSS vector indicates network accessibility (AV:N) but high attack complexity (AC:H), no privilege requirement (PR:N), and confidentiality impact only (C:L/I:N/A:N), resulting in a low severity rating. The EPSS score and exploitation status suggest this is not yet widely automated or actively exploited at scale. However, the presence of a publicly disclosed proof-of-concept (available via https://vulnplus-note.wetolink.com/share/rM8GdIOvQZrw) increases practical exploitability despite the high attack complexity. From an SSVC perspective, the exploitation status is Public (POC available), the attack is likely not automatable due to AC:H, and the technical impact is limited to confidentiality. The vendor's non-response indicates no official patch is available, making this a persistent but lower-priority vulnerability unless deployed in highly sensitive environments. Organizations with Kodbox instances exposed to untrusted networks should prioritize remediation, but this is not a critical zero-day requiring immediate emergency response.

An attacker with network access to a Kodbox instance crafts a malicious HTTP request targeting the shareSafeGroup API endpoint (/workspace/source-code/app/controller/explorer/shareOut.class.php or equivalent routing), injecting a manipulated 'sk' parameter that exploits the hard-coded cryptographic key. By reverse-engineering or guessing the embedded key (possibly from leaked source code or security research), the attacker bypasses intended access controls and retrieves sensitive file metadata or sharing information otherwise restricted to authenticated users. The attack requires technical knowledge to identify the hard-coded key and craft valid requests, explaining the high complexity rating; however, the public proof-of-concept significantly lowers the barrier for skilled attackers.