EUVD-2026-14457Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS v3.1 score of 4.7 appears moderate, the risk assessment reveals elevated real-world concern when examining all signals: The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H), which limits the initial attack surface. However, the CVSS vector includes an exploitation proof-of-concept maturity rating (E:P), indicating public exploit availability, and the vendor's non-response (RL:X, release level unknown) means no official patch timeline exists. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the current assessment, but public POC availability combined with the straightforward command injection technique means exploitation probability is moderate-to-high. This is not a low-risk CVSS quirk; rather, it is a legitimate code execution risk limited primarily by the high-privilege requirement, making it a moderate-priority issue for organizations running Kodbox with multiple administrative users. |
| Exploit ScenarioDerived | An authenticated attacker with administrative or high-privilege credentials logs into Kodbox and crafts a malicious request to the fileThumb endpoint's checkBin function, injecting OS commands such as 'rm -rf /', 'curl [malicious-url]', or reverse shell payloads via unsanitized parameter input. The low attack complexity means standard command injection techniques (e.g., command chaining with semicolons or backticks) are likely to succeed. A public proof-of-concept exploit is available (per https://vulnplus-note.wetolink.com/share/3ml5XA0firIa), reducing the barrier to entry for less-skilled attackers or enabling worm-like propagation across multiple Kodbox instances within an organization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
The fileThumb endpoint in Kodbox 1.64 contains an OS command injection vulnerability in the checkBin function that allows authenticated remote attackers to execute arbitrary commands with the privileges of the web server process. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. An attacker with high-level privileges can leverage this to achieve remote code execution on affected systems.
Earlier versions of this analysis (1)
A remote command injection vulnerability exists in Kalcaddle Kodbox version 1.64 within the fileThumb endpoint's checkBin function, allowing authenticated attackers with high privileges to execute arbitrary OS commands. A public proof-of-concept exploit is available, and the vendor has not responded to early disclosure notifications, increasing real-world exploitation risk despite the moderate CVSS score of 4.7.
RemediationAI
The primary remediation is to upgrade Kodbox to a patched version greater than 1.64 once available; however, due to the vendor's lack of response, no official patch timeline exists. Immediate interim measures include: restricting network access to the fileThumb endpoint (/workspace/source-code/plugins/fileThumb/app.php) to trusted internal IP ranges via firewall or reverse proxy rules, limiting administrative user accounts to only those requiring access, and disabling the fileThumb plugin entirely if not actively used. Additionally, implement web application firewall (WAF) rules to detect and block command injection attempts targeting the checkBin function (e.g., detecting shell metacharacters like semicolons, pipes, backticks, and command substitution syntax in request parameters). Monitor access logs for suspicious patterns in the /plugins/fileThumb/ endpoint. For long-term security, consider migrating to actively maintained file management solutions or pressure the vendor (or community forks) for a security patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the PHP-based Kodbox file management application (CPE: cpe:2.3:a:kalcaddle:kodbox:*:*:*:*:*:*:*:*), specifically in the /workspace/source-code/plugins/fileThumb/app.php file within the fileThumb component endpoint. The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that user-supplied input to the checkBin function is not properly sanitized before being passed to OS command execution functions. This is a classic command injection flaw where metacharacters or command separators in user input are interpreted as shell commands rather than literal data.
Know when Kodbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in kalcaddle kodbox 1.64. This affects the function checkBin of the file /workspace/source-code/plugins/fileThumb/app.php of the component fileThumb Endpoint. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using A weakness should be aware of moderate risk from CVE-2026-4591, a OS command injection vulnerability rated CVSS 4.7. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in kalcaddle kodbox Multiple Vulnerabilities
View all 7kodbox 1.46.01 has a security flaw that enables user enumeration. Rated critical severity (CVSS 9.8), this vulnerability
A vulnerability was found in kodbox 1.26. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. P
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. Rated high severity (CVSS 7.5), this vulnerability
Improper authentication in the password-protected share handler of Kalcaddle Kodbox 1.64 allows remote attackers to bypa
Server-side request forgery (SSRF) in Kalcaddle Kodbox up to version 1.64 allows unauthenticated remote attackers to per
An unrestricted file upload vulnerability exists in Kalcaddle Kodbox 1.64 within the Public Share Handler component's us
GitHub PoC
Exploit-DB