Which versions of PHP are affected by CVE-2026-4830?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4830, a unrestricted file upload vulnerability rated CVSS 6.3. This could allow unauthorized file access.

Is there a public PoC exploit available for CVE-2026-4830?

Yes, a public proof-of-concept exploit is available for CVE-2026-4830. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4830?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

PHP CVE-2026-4830

Q: What is the CVSS score of CVE-2026-4830?

CVE-2026-4830 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16072 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-26 VulDB

GHSA-264f-3frq-cpxq

File Upload PHP

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.9 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 01:00 euvd

EUVD-2026-16072

Analysis Generated

Mar 26, 2026 - 01:00 vuln.today

CVE Published

Mar 26, 2026 - 00:18 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the component Public Share Handler. Such manipulation leads to unrestricted upload. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

An unrestricted file upload vulnerability exists in Kalcaddle Kodbox 1.64 within the Public Share Handler component's userShare.class.php file. This allows unauthenticated remote attackers to upload arbitrary files by manipulating the Add function, potentially leading to remote code execution and system compromise. A publicly available proof-of-concept exists, and the vendor has not responded to early disclosure attempts, increasing the likelihood of active exploitation.

Technical ContextAI

The vulnerability is rooted in CWE-434 (Unrestricted Upload of File with Dangerous Type), a file upload validation flaw in PHP-based web applications. Specifically, the affected component is app/controller/explorer/userShare.class.php in Kalcaddle Kodbox, which handles public file sharing functionality. The Public Share Handler fails to properly validate or restrict file types during the Add operation, allowing attackers to bypass upload restrictions. This is a classic PHP application vulnerability where insufficient input validation on file uploads allows arbitrary file types to be written to the web-accessible directory, potentially enabling remote code execution if executable files (e.g., .php shells) are uploaded.

RemediationAI

Immediate action: Upgrade Kalcaddle Kodbox to the latest available version beyond 1.64 if a patch has been released, or contact the Kalcaddle development team for a security update timeline. If patching is not immediately available, implement compensating controls: restrict access to the public share upload functionality via network-level firewall rules or reverse proxy authentication; disable file upload functionality in the Public Share Handler if not essential; implement strict file type validation at the web server level (e.g., Apache/Nginx configuration to block executable file extensions); and monitor upload directories for suspicious file creation. Configure the web server to prevent execution of uploaded files in the target directory via .htaccess (Apache) or nginx configuration. Review access logs for suspicious upload patterns and consider deploying Web Application Firewall (WAF) rules targeting CWE-434 exploitation patterns.