EUVD-2026-14432
GHSA-f28j-gx5r-p78j
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 6.3 reflects a medium-severity network-accessible vulnerability requiring low privileges (PR:L) with low attack complexity (AC:L). The vector indicates confidentiality, integrity, and availability impacts at the low level. The EPSS score is indicated as present (E:P), suggesting elevated exploitation probability. While the CVSS score is moderate, the real-world risk is elevated by multiple factors: authentication is required (reducing opportunistic attacks), but a public exploit exists, making weaponization straightforward for authenticated users or those with stolen credentials. The vendor's lack of response and absence of a patch (RL:X indicates unknown/unavailable remedy) compounds the risk. From an SSVC perspective, this is automatable (SSRF payloads are trivial), affects a web-accessible application, and requires minimal user interaction post-authentication. Organizations running unpatched Kodbox instances should treat this as a moderate-to-high priority depending on network exposure and data sensitivity. |
| Exploit ScenarioDerived | An authenticated user (or an attacker with stolen credentials) sends a crafted request to the fileGet endpoint with a malicious 'path' parameter such as 'file://localhost:6379/' or 'http://internal-service:8080/admin'. The PathDriverUrl function constructs and executes a server-side request without validation, allowing the attacker to access internal services, read sensitive files via file:// protocol, or probe the internal network topology. The public proof-of-concept exploit, hosted at https://vulnplus-note.wetolink.com/share/UTZQq38f9VyI, demonstrates a working attack method requiring only valid authentication credentials and a single HTTP request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
Server-side request forgery in Kodbox 1.64's fileGet endpoint allows authenticated attackers to manipulate the path parameter in the PathDriverUrl function, enabling arbitrary outbound requests from the affected server. Public exploit code exists for this vulnerability, and no patch is currently available. The impact is limited to users with valid credentials, though successful exploitation could facilitate further network reconnaissance or attacks against internal systems.
Earlier versions of this analysis (1)
A server-side request forgery (SSRF) vulnerability exists in Kalcaddle Kodbox 1.64 within the PathDriverUrl function of the editor.class.php file, affecting the fileGet endpoint. An authenticated attacker can manipulate the 'path' parameter to trigger arbitrary server-side requests, potentially leading to information disclosure, internal network reconnaissance, or lateral movement. A public exploit is available, and the vendor has not responded to early disclosure attempts.
RemediationAI
The primary remediation is to upgrade Kodbox to a patched version once available; however, as the vendor has not responded to disclosure, no official patch exists at this time. Immediate mitigation strategies include: enforce network segmentation to restrict Kodbox server's outbound access to only necessary internal and external destinations (whitelist approach), restrict the fileGet endpoint to trusted users, implement WAF rules to detect and block SSRF payloads (e.g., requests with localhost, 127.0.0.1, 169.254.x.x, or private IP ranges in the path parameter), and monitor outbound connections from the Kodbox application server. Until a vendor patch is released, consider disabling file management features if not actively required or migrating to an alternative file management solution. Monitor VulDB (https://vuldb.com/?submit.775467) and the vendor's repository for security updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-918 (Server-Side Request Forgery), a classic web application flaw where user-supplied input is used to construct server-side requests without proper validation. In this case, the PathDriverUrl function in Kodbox's PHP-based explorer/editor component processes the 'path' argument from the fileGet endpoint without adequately sanitizing or validating the input. Kodbox (cpe:2.3:a:kalcaddle:kodbox) is a lightweight PHP-based file management and collaboration platform. The PHP backend processes file operations and URL construction, making it susceptible to SSRF when path parameters allow protocol schemes or special characters that redirect requests to unintended destinations (internal IP ranges, localhost services, or external targets).
Know when Kodbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4589, a server-side request forgery vulnerability rated CVSS 6.3. Users could be tricked into performing unintended actions. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement egress filtering, block metadata endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Related Vulnerabilities in kalcaddle kodbox Multiple Vulnerabilities
View all 7kodbox 1.46.01 has a security flaw that enables user enumeration. Rated critical severity (CVSS 9.8), this vulnerability
A vulnerability was found in kodbox 1.26. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. P
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. Rated high severity (CVSS 7.5), this vulnerability
Improper authentication in the password-protected share handler of Kalcaddle Kodbox 1.64 allows remote attackers to bypa
Server-side request forgery (SSRF) in Kalcaddle Kodbox up to version 1.64 allows unauthenticated remote attackers to per
An unrestricted file upload vulnerability exists in Kalcaddle Kodbox 1.64 within the Public Share Handler component's us
Exploit-DB