CVE-2025-10233

MediumCVSS 6.3

Published: 10/09/2025(UTC)Updated: 26/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

36th percentile - higher than 36% of all known CVEs

Summary

kalcaddle kodbox 1.61 has a path traversal vulnerability in the fileGet/fileSave functions in app/controller/explorer/editor.class.php via the path argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Risk Assessment

Path traversal could allow an attacker to read or write files outside the intended directory, potentially exposing sensitive data or gaining control of the system.

Recommendation

Apply vendor patches or implement path validation and restrict access to the application.

Other vulnerabilities in kalcaddle kodbox

CVE-2026-18720Medium
A flaw has been found in kalcaddle kodbox 1.67 Build 02. The vulnerability affects unknown code in the file /index.php?plugin/msgWarning/action of the msgWarning Plugin component. Manipulation can lead to improper authorization, and the attack can be launched remotely. The exploit has been published and may be used.

Original NVD description (English source)

A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS