EUVD-2026-16072
GHSA-264f-3frq-cpxq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS 3.1 score of 5.6 indicates moderate severity with a network attack vector (AV:N) and high attack complexity (AC:H), the real-world risk is elevated by several factors: the publicly available proof-of-concept (E:P) significantly increases exploitation probability; the unauthenticated, no-privilege-required attack (PR:N, UI:N) lowers barriers to entry; and vendor non-responsiveness suggests no patch is forthcoming. However, the high attack complexity (AC:H) requirement suggests this is not a trivial one-click exploit. The combination of public POC availability, no vendor remediation, and remote unauthenticated access makes this a moderate-to-high priority despite the moderate CVSS score. The confidentiality, integrity, and availability impacts (C:L, I:L, A:L) are limited by CVSS but could escalate significantly if the uploaded files achieve code execution. |
| Exploit ScenarioDerived | An attacker discovers a public share link in Kodbox 1.64 and crafts a malicious HTTP request to the Public Share Handler's Add function, bypassing file type validation to upload a PHP webshell. Although the attack requires high complexity (possibly necessitating knowledge of the share token format or parameter structure), once the shell is uploaded to a web-accessible directory, the attacker gains remote code execution by accessing the uploaded file via HTTP. This scenario is plausible given the publicly available proof-of-concept and high likelihood of internet-facing Kodbox installations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
An unrestricted file upload vulnerability exists in Kalcaddle Kodbox 1.64 within the Public Share Handler component's userShare.class.php file. This allows unauthenticated remote attackers to upload arbitrary files by manipulating the Add function, potentially leading to remote code execution and system compromise. A publicly available proof-of-concept exists, and the vendor has not responded to early disclosure attempts, increasing the likelihood of active exploitation.
RemediationAI
Immediate action: Upgrade Kalcaddle Kodbox to the latest available version beyond 1.64 if a patch has been released, or contact the Kalcaddle development team for a security update timeline. If patching is not immediately available, implement compensating controls: restrict access to the public share upload functionality via network-level firewall rules or reverse proxy authentication; disable file upload functionality in the Public Share Handler if not essential; implement strict file type validation at the web server level (e.g., Apache/Nginx configuration to block executable file extensions); and monitor upload directories for suspicious file creation. Configure the web server to prevent execution of uploaded files in the target directory via .htaccess (Apache) or nginx configuration. Review access logs for suspicious upload patterns and consider deploying Web Application Firewall (WAF) rules targeting CWE-434 exploitation patterns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-434 (Unrestricted Upload of File with Dangerous Type), a file upload validation flaw in PHP-based web applications. Specifically, the affected component is app/controller/explorer/userShare.class.php in Kalcaddle Kodbox, which handles public file sharing functionality. The Public Share Handler fails to properly validate or restrict file types during the Add operation, allowing attackers to bypass upload restrictions. This is a classic PHP application vulnerability where insufficient input validation on file uploads allows arbitrary file types to be written to the web-accessible directory, potentially enabling remote code execution if executable files (e.g., .php shells) are uploaded.
Know when Kodbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the component Public Share Handler. Such manipulation leads to unrestricted upload. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4830, a unrestricted file upload vulnerability rated CVSS 6.3. This could allow unauthorized file access. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Related Vulnerabilities in kalcaddle kodbox Security Flaws
View all 2kodbox 1.46.01 has a security flaw that enables user enumeration. Rated critical severity (CVSS 9.8), this vulnerability
A vulnerability was found in kodbox 1.26. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. P
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. Rated high severity (CVSS 7.5), this vulnerability
Improper authentication in the two-factor authentication verification function of Kalcaddle Kodbox 1.64 allows remote at
Server-side request forgery (SSRF) in Kalcaddle Kodbox up to version 1.64 allows unauthenticated remote attackers to per
Kalcaddle Kodbox 1.64 contains a cryptographic key hardcoding vulnerability in the Site-level API key Handler component
Remote command injection in Kodbox fileThumb plugin (versions up to 1.64) allows authenticated attackers to execute arbi
Exploit-DB