CVE-2026-1066: Kalcaddle KodBox RCE Vulnerability

CVE-2026-1066 Overview

A command injection vulnerability has been identified in kalcaddle kodbox up to version 1.61.10. This security flaw affects unknown processing within the file /?explorer/index/zip of the Compression Handler component. The manipulation of input parameters results in command injection, allowing attackers to execute arbitrary system commands on vulnerable servers. This vulnerability can be exploited remotely by authenticated users. The exploit has been publicly disclosed, and the vendor was contacted early about this disclosure but did not respond.

Critical Impact

Authenticated attackers can remotely execute arbitrary commands on the server through the vulnerable Compression Handler, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• kalcaddle kodbox up to version 1.61.10
• Compression Handler component (/?explorer/index/zip)

Discovery Timeline

• 2026-01-17 - CVE-2026-1066 published to NVD
• 2026-01-17 - Last updated in NVD database

Technical Details for CVE-2026-1066

Vulnerability Analysis

This vulnerability falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly referred to as Injection vulnerabilities. The flaw exists in the Compression Handler component of kodbox, specifically in the endpoint /?explorer/index/zip.

When a user requests file compression functionality, the application fails to properly sanitize user-controlled input before passing it to system-level commands. This allows an attacker with valid credentials to inject arbitrary shell commands that execute with the privileges of the web server process. The network-accessible nature of this vulnerability combined with low attack complexity makes it particularly concerning for organizations running exposed kodbox instances.

Root Cause

The root cause of this vulnerability is insufficient input validation and improper neutralization of special characters in the Compression Handler. When processing ZIP compression requests, the application constructs system commands using user-supplied file paths or parameters without adequate sanitization. Special shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax are not properly escaped, allowing attackers to break out of the intended command context and inject malicious commands.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker must first obtain valid credentials to access the kodbox application. Once authenticated, the attacker can craft malicious requests to the /?explorer/index/zip endpoint with specially crafted parameters containing command injection payloads. These payloads exploit the lack of input sanitization in the Compression Handler to execute arbitrary system commands on the underlying server.

The vulnerability allows an attacker to potentially read sensitive files, modify system configurations, establish persistence mechanisms, or pivot to other systems on the network. Given that the exploit is publicly available, organizations running vulnerable versions face heightened risk of exploitation. For detailed technical analysis and proof-of-concept information, refer to the GitHub PoC Repository.

Detection Methods for CVE-2026-1066

Indicators of Compromise

• Unusual requests to /?explorer/index/zip containing shell metacharacters (;, |, $(), backticks)
• Web server processes spawning unexpected child processes (e.g., /bin/sh, /bin/bash, cmd.exe)
• Anomalous outbound network connections from the web server
• Unexpected files created in web-accessible directories or system paths

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block command injection patterns in requests to the kodbox application
• Monitor web server access logs for suspicious requests to the /?explorer/index/zip endpoint with encoded or special characters
• Deploy endpoint detection and response (EDR) solutions to identify command execution anomalies from web server processes
• Configure intrusion detection systems (IDS) to alert on known command injection attack signatures

Monitoring Recommendations

• Enable detailed logging for all requests to the kodbox Compression Handler endpoint
• Monitor process creation events on servers running kodbox for shell spawns from web server parent processes
• Implement file integrity monitoring for critical system files and directories
• Review authentication logs for unusual access patterns that may precede exploitation attempts

How to Mitigate CVE-2026-1066

Immediate Actions Required

• Restrict network access to kodbox instances using firewall rules or network segmentation
• Implement strong authentication controls and review user account privileges
• Deploy a web application firewall with command injection protection rules
• Consider temporarily disabling the Compression Handler functionality if not business-critical

Patch Information

At the time of publication, the vendor (kalcaddle) has not responded to disclosure attempts and no official patch is available. Organizations should monitor the vendor's official channels for security updates. Until a patch is released, implementing the workarounds below is strongly recommended. For additional context and community updates, refer to VulDB #341665.

Workarounds

• Implement input validation at the web server or reverse proxy level to filter dangerous characters from requests to vulnerable endpoints
• Use a web application firewall to block requests containing shell metacharacters destined for /?explorer/index/zip
• Restrict access to the kodbox application to trusted IP addresses only
• Run the kodbox application with minimal system privileges to limit the impact of successful command injection

# Example: Nginx configuration to block suspicious requests to the vulnerable endpoint
location ~ ^/\?explorer/index/zip {
    # Block common command injection patterns
    if ($args ~* "[;|`$()&]") {
        return 403;
    }
    # Additional access control - restrict to internal IPs only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}