EUVD-2026-14432
GHSA-f28j-gx5r-p78j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
AnalysisAI
Server-side request forgery in Kodbox 1.64's fileGet endpoint allows authenticated attackers to manipulate the path parameter in the PathDriverUrl function, enabling arbitrary outbound requests from the affected server. Public exploit code exists for this vulnerability, and no patch is currently available. The impact is limited to users with valid credentials, though successful exploitation could facilitate further network reconnaissance or attacks against internal systems.
Technical ContextAI
The vulnerability is rooted in CWE-918 (Server-Side Request Forgery), a classic web application flaw where user-supplied input is used to construct server-side requests without proper validation. In this case, the PathDriverUrl function in Kodbox's PHP-based explorer/editor component processes the 'path' argument from the fileGet endpoint without adequately sanitizing or validating the input. Kodbox (cpe:2.3:a:kalcaddle:kodbox) is a lightweight PHP-based file management and collaboration platform. The PHP backend processes file operations and URL construction, making it susceptible to SSRF when path parameters allow protocol schemes or special characters that redirect requests to unintended destinations (internal IP ranges, localhost services, or external targets).
RemediationAI
The primary remediation is to upgrade Kodbox to a patched version once available; however, as the vendor has not responded to disclosure, no official patch exists at this time. Immediate mitigation strategies include: enforce network segmentation to restrict Kodbox server's outbound access to only necessary internal and external destinations (whitelist approach), restrict the fileGet endpoint to trusted users, implement WAF rules to detect and block SSRF payloads (e.g., requests with localhost, 127.0.0.1, 169.254.x.x, or private IP ranges in the path parameter), and monitor outbound connections from the Kodbox application server. Until a vendor patch is released, consider disabling file management features if not actively required or migrating to an alternative file management solution. Monitor VulDB (https://vuldb.com/?submit.775467) and the vendor's repository for security updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today