A vulnerability was detected in kalcaddle kodbox up to 1.64.

CVE-2026-5618 is a pre-authentication Server-Side Request Forgery (SSRF) in kalcaddle kodbox ≤ 1.64, a self-hosted PHP web file manager. The vulnerable endpoints are explorer/shareOut/shareMake and shareCheck. A hard-coded cryptographic key (kodShareOut) used in a custom Mcrypt-based _check token design allows an unauthenticated attacker to forge authorization tokens offline, then create or modify external collaboration ("shareOut") records. By manipulating the siteFrom/siteTo parameters, the attacker can coerce the server into making HTTP requests to attacker-controlled or internal URLs — classic blind SSRF. Versions 1.0 through 1.64 are affected; versions 1.65.03+ appear to address the issue, though the vendor never publicly acknowledged the flaw.

The vendor's MEDIUM / 5.6 CVSS 3.1 score overstates the real-world risk. NVD's own CVSS 4.0 re-score landed at 2.9 (LOW), which is closer to reality. The SSRF yields only Low confidentiality, Low integrity, Low availability impact — there is no documented path to full response read-back, RCE, or credential theft. The affected product is a niche self-hosted file manager with roughly 3,500 internet-facing instances per Shodan, overwhelmingly operated by hobbyists and small businesses, not enterprise-scale deployments. The combination of limited blast radius, tiny exposure population, and no evidence of in-the-wild exploitation makes this a backlog item, not a fire drill.

Why this verdict

• Tiny exposure population: ~3,500 internet-facing instances globally, overwhelmingly hobbyist/small-business — finding a high-value enterprise target is a needle-in-a-haystack exercise.
• Limited SSRF impact: CVSS rates C:L/I:L/A:L with no scope change. No researcher or PoC has demonstrated escalation to RCE, full file read, or credential theft. This is blind or partial-read SSRF at best.
• No high-value role multiplier: kodbox is a web file manager. It is not deployed as an identity provider, domain controller, hypervisor, CI/CD server, backup appliance, or network edge device. The blast radius of compromise is limited to the kodbox host and its locally stored files — no fleet-scale, identity-scale, or supply-chain impact.
• Role multiplier: Evaluated against the high-value role catalog — kodbox does not match any category. In its typical deployment (standalone file-sharing server on a small network), compromise yields access to one host's files. Even in the rare case of an enterprise deployment with AD integration, the SSRF itself does not yield credentials or tokens that would enable domain escalation.
• Modern compensating controls reduce residual risk: IMDSv2 blocks cloud metadata SSRF; network segmentation limits internal reach; WAF rules can block RFC 1918 addresses in request parameters.

Why not higher?

The pre-authentication nature and public PoC initially suggest concern, but the SSRF impact is capped at Low CIA with no demonstrated escalation. The product has no meaningful enterprise installed base — it is not infrastructure software. There is no KEV listing, no active exploitation, and EPSS is in the bottom 1%. Upgrading to MEDIUM would overstate the risk to an enterprise defender managing 10,000 hosts who almost certainly has zero kodbox instances.

Why not lower?

Despite the tiny footprint, this is still a pre-auth vulnerability with a public PoC that could be weaponized against the small number of exposed instances. The hard-coded key effectively negates the AC:H rating since the key is now public knowledge, making exploitation more reliable than the CVSS vector implies. Marking IGNORE would be inappropriate if even one kodbox instance exists in the environment.

1. Block external access to kodbox or place behind VPN/zero-trust proxy — If you run kodbox, it should not be directly internet-facing. Place it behind a VPN, Cloudflare Access, Tailscale, or similar zero-trust gateway. This eliminates the remote attack vector entirely. No noisgate mitigation SLA applies for LOW — treat as backlog hygiene.
2. Upgrade to kodbox ≥ 1.65.03 — The fix appears to ship in 1.65.03 (2026-03-30). Latest is 1.69.03. Upgrade at your convenience within the noisgate remediation window for LOW (backlog).
3. WAF rule blocking internal IPs in siteFrom/siteTo parameters — If you must keep kodbox internet-facing temporarily, add a WAF rule that rejects requests to explorer/shareOut/shareMake containing RFC 1918, link-local (169.254.x.x), or localhost addresses in the siteFrom/siteTo parameters.
4. Enforce IMDSv2 on cloud instances — If kodbox runs on AWS/GCP/Azure, enforce IMDSv2 (or equivalent) to prevent SSRF-based cloud metadata theft. This is a general hygiene measure that neutralizes the most valuable SSRF target.

Run this on the kodbox host (or any host that can reach the kodbox web root directory) as a user with read access to the kodbox PHP files. Example: bash check_cve_2026_5618.sh /var/www/kodbox

#!/usr/bin/env bash
# CVE-2026-5618 checker for kalcaddle kodbox
# Checks installed version against the fix threshold (1.65.03)
# Usage: bash check_cve_2026_5618.sh /path/to/kodbox
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

KODBOX_ROOT="${1:-/var/www/kodbox}"
VERSION_FILE="$KODBOX_ROOT/config/version.php"

if [ ! -f "$VERSION_FILE" ]; then
  # Try alternate location
  VERSION_FILE="$KODBOX_ROOT/app/controller/config.php"
fi

if [ ! -f "$VERSION_FILE" ]; then
  echo "UNKNOWN — Could not locate kodbox version file at $KODBOX_ROOT"
  exit 2
fi

# Extract version string
VERSION=$(grep -oP "['\"]version['\"]\s*=>\s*['\"]\K[0-9.]+" "$VERSION_FILE" 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  # Fallback: look for KOD_VERSION constant
  VERSION=$(grep -oP "KOD_VERSION['\",\s]+['\"]\K[0-9.]+" "$VERSION_FILE" 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not parse version from $VERSION_FILE"
  exit 2
fi

echo "Detected kodbox version: $VERSION"

# Compare versions (1.65.03 is the fix threshold)
# Normalize: 1.64 -> 1.64.0, 1.65.03 -> 1.65.03
version_gte() {
  printf '%s\n%s' "$2" "$1" | sort -t. -k1,1n -k2,2n -k3,3n -C
}

FIX_VERSION="1.65.03"

if version_gte "$VERSION" "$FIX_VERSION"; then
  echo "PATCHED — kodbox $VERSION >= $FIX_VERSION (CVE-2026-5618 fixed)"
  exit 0
else
  echo "VULNERABLE — kodbox $VERSION < $FIX_VERSION (CVE-2026-5618 applies)"
  # Also check for the hard-coded key as confirmation
  if grep -rq 'kodShareOut' "$KODBOX_ROOT/app/" 2>/dev/null; then
    echo "  Confirmed: hard-coded key 'kodShareOut' found in source"
  fi
  exit 1
fi

Sources

1. NVD — CVE-2026-5618
2. VulDB Entry #355408
3. Vulnerability-Lookup — CVE-2026-5618
4. GHSA-582G-J67J-5Q79 — GitHub Advisory
5. kodbox GitHub Releases
6. kodbox GitHub Repository
7. THREATINT — CVE-2026-5618