CVE-2026-5618
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In kodbox up to version 1.64, a Server-Side Request Forgery (SSRF) vulnerability exists in the shareMake/shareCheck component. Manipulating the siteFrom/siteTo arguments allows server-side requests. The attack is remote but difficult. The exploit is public. The vendor did not respond.
Risk Assessment
The risk involves the ability to make HTTP requests to internal or external resources by an attacker, potentially leading to data exposure or further attack escalation.
Recommendation
Restrict access to the application and monitor the project for patches. Until an update is available, manually secure the endpoints.
Original NVD description (English source)
A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.