EUVD-2026-19164Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 5.6 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R reflects several competing signals. Network-accessible attack vector (AV:N) and no privilege requirement (PR:N) indicate broad reachability, but high attack complexity (AC:H) and difficult exploitability (E:P) suggest technical barriers to successful exploitation. The presence of publicly available exploit code (POC/Exploit: Publicly available) combined with lack of vendor response (RL:X) elevates practical risk despite the moderate CVSS score. The vulnerability impacts confidentiality, integrity, and availability equally (C:L/I:L/A:L), typical of SSRF allowing reconnaissance, data exfiltration, and potential service disruption. From an SSVC perspective, this represents a credible but non-trivial threat: exploitation is possible (not probabilistic), automatable once the attack pattern is known, and can enable lateral movement or information gathering. Organizations running Kodbox 1.64 or earlier should prioritize assessment and remediation, though the high attack complexity means casual exploitation is unlikely without specialized knowledge. Real-world risk depends heavily on network architecture and what resources the Kodbox server can reach from its network position. |
| Exploit ScenarioDerived | An attacker discovers a Kodbox instance running version 1.64 or earlier and crafts a malicious request to the shareMake or shareCheck endpoint, manipulating the siteFrom parameter to point to an internal service such as a metadata endpoint (http://169.254.169.254) or internal application server. The server, lacking proper input validation, makes the request on behalf of the attacker and returns the response, allowing the attacker to enumerate internal services, extract credentials from metadata services, or probe internal network topology. With publicly available exploit code, an attacker with moderate technical skill can execute this attack remotely without authentication or user interaction, though the high attack complexity requirement (AC:H) means the attack may require specific environmental knowledge or multiple request iterations to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
Server-side request forgery (SSRF) in Kalcaddle Kodbox up to version 1.64 allows unauthenticated remote attackers to perform arbitrary network requests via manipulation of the siteFrom/siteTo parameters in the shareMake/shareCheck component, with publicly available exploit code and high attack complexity. The vendor has not responded to disclosure efforts, leaving affected installations vulnerable to information disclosure and potential lateral network attacks.
RemediationAI
Upgrade Kalcaddle Kodbox to a version greater than 1.64 immediately; however, no specific patched version number has been independently confirmed from vendor advisory at time of analysis. Since the vendor (Kalcaddle) has not responded to disclosure efforts and no official patch acknowledgment is documented, users should verify the latest available release from the official Kalcaddle Kodbox repository and test compatibility before deployment. As a temporary mitigation, restrict network access to the shareMake and shareCheck endpoints via web application firewall or reverse proxy rules, and implement strict input validation/filtering on siteFrom and siteTo parameters to block requests to private IP ranges (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and local metadata services. Monitor outbound connections from Kodbox instances for anomalous SSRF activity. Additional vulnerability details and any community-provided patches may be available at https://vuldb.com/vuln/355408/cti.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits improper input validation in Kodbox's file sharing functionality, specifically the shareMake and shareCheck components. The root cause is classified as CWE-918 (Server-Side Request Forgery), indicating that user-supplied siteFrom and siteTo parameters are not adequately sanitized before being used in server-side HTTP requests. An attacker can manipulate these parameters to redirect the server into making requests to unintended internal or external targets, bypassing normal network segmentation and access controls. Kodbox is a cloud storage and file management system, and the vulnerable endpoint is part of its sharing mechanism. The CPE designation cpe:2.3:a:kalcaddle:kodbox:*:*:*:*:*:*:*:* indicates all versions up to and including 1.64 are affected.
Know when Kodbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
kodbox 1.46.01 has a security flaw that enables user enumeration. Rated critical severity (CVSS 9.8), this vulnerability
A vulnerability was found in kodbox 1.26. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. P
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. Rated high severity (CVSS 7.5), this vulnerability
Improper authentication in the password-protected share handler of Kalcaddle Kodbox 1.64 allows remote attackers to bypa
Improper authentication in the two-factor authentication verification function of Kalcaddle Kodbox 1.64 allows remote at
An unrestricted file upload vulnerability exists in Kalcaddle Kodbox 1.64 within the Public Share Handler component's us
Kalcaddle Kodbox 1.64 contains a cryptographic key hardcoding vulnerability in the Site-level API key Handler component
Remote command injection in Kodbox fileThumb plugin (versions up to 1.64) allows authenticated attackers to execute arbi
GitHub PoC
Exploit-DB