CVE-2025-10233: Kodcloud Kodbox Path Traversal Vulnerability

CVE-2025-10233 Overview

CVE-2025-10233 is a path traversal vulnerability (CWE-22) in kalcaddle kodbox 1.61, an open-source web-based file management platform. The flaw resides in the fileGet and fileSave functions inside app/controller/explorer/editor.class.php. Manipulation of the path argument allows an authenticated remote attacker to read or write files outside the intended directory. The exploit has been publicly disclosed. According to the CVE record, the vendor was contacted but did not respond to the disclosure.

Critical Impact
Authenticated remote attackers can traverse the file system through the path parameter in editor.class.php, exposing or modifying files outside the kodbox working directory.

Affected Products

kodcloud kodbox version 1.61
Deployments exposing app/controller/explorer/editor.class.php endpoints
Any hosting environment running the vulnerable kodbox release

Discovery Timeline

2025-09-10 - CVE-2025-10233 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10233

Vulnerability Analysis

The vulnerability exists in the file editor controller app/controller/explorer/editor.class.php within kodbox 1.61. The fileGet and fileSave methods accept a client-supplied path argument and use it to resolve the target file for read or write operations. Because the argument is not properly normalized or constrained to the application's file scope, an attacker can supply directory traversal sequences to escape the intended directory.

The attack is initiated over the network and requires low-privilege authentication. Successful exploitation results in limited disclosure or modification of files accessible to the web server process. This behavior is characteristic of an Improper Limitation of a Pathname to a Restricted Directory weakness [CWE-22].

Root Cause

The root cause is missing canonicalization and validation of the path parameter before it is passed to file I/O routines. The controller trusts user-supplied input to identify the file resource, which permits traversal sequences such as parent directory references to reach arbitrary paths on the underlying filesystem.

Attack Vector

An authenticated user sends a crafted HTTP request to the kodbox editor endpoint that invokes fileGet or fileSave. The attacker sets the path parameter to a traversal string pointing outside the kodbox data directory. The fileGet handler returns file contents from the traversed location, while fileSave writes attacker-controlled content to the traversed location. Impact is bounded by the web server user's filesystem permissions.

No verified proof-of-concept code is included in this advisory. Technical details are documented in the GitHub Yu Documentation 1 and GitHub Yu Documentation 2 references, as well as the VulDB entry 323502.

Detection Methods for CVE-2025-10233

Indicators of Compromise

HTTP requests to kodbox editor endpoints containing ../ or URL-encoded %2e%2e%2f sequences in the path parameter.
Unexpected reads or writes by the web server process to files outside the kodbox installation or data directories.
Log entries in app/controller/explorer/editor.class.php handlers referencing absolute paths or paths outside the configured user home.

Detection Strategies

Inspect application and web server access logs for requests targeting the editor controller with traversal patterns in query or POST parameters.
Deploy web application firewall (WAF) rules that normalize and reject path traversal encodings against kodbox endpoints.
Correlate authenticated user sessions with abnormal file access patterns spanning directories outside their assigned scope.

Monitoring Recommendations

Enable verbose PHP and web server logging for the kodbox explorer/editor routes and forward logs to a centralized analytics platform.
Monitor filesystem integrity on directories adjacent to the kodbox install path for unexpected writes by the web server user.
Alert on outbound HTTP responses returning file contents from system paths such as /etc/, /var/www/, or Windows configuration directories.

How to Mitigate CVE-2025-10233

Immediate Actions Required

Restrict network exposure of kodbox 1.61 instances until a vendor patch is available, limiting access to trusted networks or VPN users only.
Audit kodbox user accounts and disable any accounts that do not require file editor privileges.
Deploy WAF or reverse proxy rules that block traversal sequences in requests to index.php?...editor... endpoints.

Patch Information

As of the last NVD update on 2026-06-17, no vendor patch is referenced in the CVE record. The CVE description states the vendor was contacted early but did not respond. Administrators should monitor the kodbox project repository and VulDB CTI entry 323502 for updated fix information.

Workarounds

Run kodbox under a dedicated low-privilege operating system account with filesystem access limited to the kodbox data directory.
Apply mandatory access controls (SELinux, AppArmor) to confine the PHP-FPM or web server worker to the kodbox installation path.
Add server-side rewrite rules that strip or reject .., %2e%2e, and null byte sequences in parameters submitted to editor endpoints.

bash

# Configuration example: restrict PHP open_basedir to kodbox directories
# Add to php.ini or vhost configuration for the kodbox site
php_admin_value open_basedir "/var/www/kodbox/:/var/www/kodbox/data/:/tmp/"

# Example nginx rule to block traversal sequences on the editor endpoint
location ~ /app/controller/explorer/editor\.class\.php {
    if ($args ~* "(\.\./|%2e%2e|%00)") {
        return 403;
    }
}