CVE-2026-4830 Details
Description
A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the component Public Share Handler. Such manipulation leads to unrestricted upload. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability in Kalcaddle Kodbox version 1.64 allows for unrestricted file uploads, which can lead to remote code execution. This issue arises in the Public Share Handler component, specifically within the Add function of the app/controller/explorer/userShare.class.php file. The vulnerability can be exploited by creating a public share link that points to the web server's document root, enabling any user with the share link to upload malicious PHP files that are executed by the server.
To address this vulnerability, it is recommended to disallow public shares on real filesystem paths, prohibit upload and edit permissions for shares on such paths, and implement strict validation of uploaded files to prevent dangerous file types from being executed on the web server.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 26, 2026CISA-ADP
Assessed Mar 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/?ctiid.353127 | [email protected] | Content Wall |
| https://vuldb.com/?id.353127 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.775479 | [email protected] | ExploitTechnical Description |
| https://vulnplus-note.wetolink.com/share/7oB22Zhc6u5X | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kalcaddle kodbox | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |