Kalcaddle Kodbox vulnerabilities

CVE-2026-1066 [HIGH] CWE-74 CVE-2026-1066: A vulnerability was detected in kalcaddle kodbox up to 1.61.10. This issue affects some unknown proc A vulnerability was detected in kalcaddle kodbox up to 1.61.10. This issue affects some unknown processing of the file /?explorer/index/zip of the component Compression Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosur

CVE-2023-6848 [CRITICAL] CWE-77 CVE-2023-6848: A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the argument soffice leads to command injection. The attack can be launched remotely. The exploit has been disclos

CVE-2026-2560 [MEDIUM] CWE-77 CVE-2026-2560: A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the functi A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib/VideoResize.class.php of the component Media File Preview Plugin. Such manipulation of the argument localFile leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to t

CVE-2023-6849 [CRITICAL] CWE-918 CVE-2023-6849: A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the file plugins/fileThumb/app.php. The manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upg

CVE-2026-8753 [MEDIUM] CWE-74 CVE-2026-8753: A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the fu A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely.

CVE-2026-4589 [MEDIUM] CWE-918 CVE-2026-4589: A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDr A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publi

CVE-2026-5618 [MEDIUM] CWE-918 CVE-2026-5618: A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is repor

CVE-2026-4591 [MEDIUM] CWE-77 CVE-2026-4591: A weakness has been identified in kalcaddle kodbox 1.64. This affects the function checkBin of the f A weakness has been identified in kalcaddle kodbox 1.64. This affects the function checkBin of the file /workspace/source-code/plugins/fileThumb/app.php of the component fileThumb Endpoint. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used

CVE-2026-4592 [MEDIUM] CWE-287 CVE-2026-4592: A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function login A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of the file /workspace/source-code/plugins/client/controller/tfa/index.class.php of the component Password Login. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is conside

CVE-2026-4830 [MEDIUM] CWE-284 CVE-2026-4830: A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/explorer/userShare.class.php of the component Public Share Handler. Such manipulation leads to unrestricted upload. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed a

CVE-2025-9414 [MEDIUM] CWE-918 CVE-2025-9414: A vulnerability was found in kalcaddle kodbox 1.61. Affected by this vulnerability is an unknown fun A vulnerability was found in kalcaddle kodbox 1.61. Affected by this vulnerability is an unknown functionality of the file /?explorer/upload/serverDownload of the component Download from Link Handler. Performing manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been

CVE-2025-11016 [MEDIUM] CWE-22 CVE-2025-11016: A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09. The affected element i A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09. The affected element is the function fileOut of the file app/controller/explorer/index.class.php. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was

CVE-2025-10233 [MEDIUM] CWE-22 CVE-2025-10233: A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileG A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted ear

CVE-2026-4831 [LOW] CWE-287 CVE-2026-4831: A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the fi A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.class.php of the component Password-protected Share Handler. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The complexity of an attack

CVE-2026-4588 [LOW] CWE-320 CVE-2026-4588: A vulnerability was determined in kalcaddle kodbox 1.64. Impacted is the function shareSafeGroup of A vulnerability was determined in kalcaddle kodbox 1.64. Impacted is the function shareSafeGroup of the file /workspace/source-code/app/controller/explorer/shareOut.class.php of the component Site-level API key Handler. This manipulation of the argument sk causes use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of

CVE-2026-4590 [LOW] CWE-352 CVE-2026-4590: A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown fun A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /workspace/source-code/plugins/oauth/controller/bind/index.class.php of the component loginSubmit API. Performing a manipulation of the argument third results in cross-site request forgery. Remote exploitation of the attack is possible. A