CVE-2026-4830: Kalcaddle KodBox RCE Vulnerability

CVE-2026-4830 Overview

A vulnerability has been identified in kalcaddle kodbox version 1.64 that allows unrestricted file upload through the Public Share Handler component. The vulnerability exists in the Add function within the file app/controller/explorer/userShare.class.php. This improper access control flaw enables remote attackers to upload arbitrary files to the target system, potentially leading to remote code execution or other malicious activities.

Critical Impact
Remote attackers can exploit this unrestricted file upload vulnerability to upload malicious files to vulnerable kodbox installations, potentially gaining unauthorized access or executing arbitrary code on the server.

Affected Products

kalcaddle kodbox 1.64
kodbox Public Share Handler component
app/controller/explorer/userShare.class.php - Add function

Discovery Timeline

2026-03-26 - CVE-2026-4830 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4830

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), indicating that the application fails to properly restrict user actions or enforce authorization checks during the file upload process. The vulnerability resides in the Public Share Handler functionality of kodbox, specifically within the Add function located in app/controller/explorer/userShare.class.php.

The exploitation of this vulnerability is characterized as having high complexity, meaning that while the attack can be executed remotely over the network, successfully exploiting the flaw requires specific conditions to be met or additional knowledge about the target environment. An exploit has been publicly disclosed, increasing the risk profile for unpatched installations.

According to the CVE disclosure, the vendor (kalcaddle) was contacted regarding this vulnerability but did not respond, leaving users without an official patch at the time of publication.

Root Cause

The root cause of this vulnerability is improper access control in the file upload functionality. The Add function in the userShare.class.php file does not adequately validate or restrict file uploads through the public share mechanism. This allows attackers to bypass intended security restrictions and upload files that should otherwise be blocked, such as executable scripts or malicious payloads.

Attack Vector

The attack is network-based, allowing remote exploitation without requiring authentication. The attacker targets the Public Share Handler component by sending crafted requests to the Add function endpoint. Despite the high complexity rating, the attack requires no user interaction and no special privileges, making any publicly accessible kodbox instance a potential target.

The exploitation flow involves:

Identifying a vulnerable kodbox installation (version 1.64)
Crafting malicious file upload requests targeting the public share functionality
Bypassing insufficient access controls to upload arbitrary files
Potentially achieving code execution if uploaded files can be executed by the web server

For detailed technical analysis and proof-of-concept information, refer to the VulnPlus Note documentation and VulDB entry #353127.

Detection Methods for CVE-2026-4830

Indicators of Compromise

Unexpected files appearing in kodbox storage directories, particularly executable scripts (.php, .phtml, .asp, .aspx)
Anomalous HTTP POST requests to /app/controller/explorer/userShare.class.php or related share endpoints
Web server logs showing unusual file upload activity to public share paths
Presence of webshells or backdoor files in upload directories

Detection Strategies

Monitor HTTP traffic for POST requests targeting the public share handler with suspicious file extensions
Implement file integrity monitoring on kodbox installation directories to detect unauthorized file additions
Review web application firewall (WAF) logs for attempts to upload executable content through share functionality
Deploy SentinelOne Singularity Platform for real-time endpoint detection of malicious file uploads and subsequent execution attempts

Monitoring Recommendations

Enable detailed logging for all file upload operations in kodbox
Configure alerts for file uploads containing executable content or suspicious file extensions
Monitor for process execution originating from web-accessible directories
Implement regular security audits of shared folders and uploaded content

How to Mitigate CVE-2026-4830

Immediate Actions Required

Restrict public access to kodbox instances until a patch is available
Implement web application firewall (WAF) rules to block suspicious file upload attempts to share endpoints
Disable or restrict the Public Share feature if not required for business operations
Review and audit existing uploaded files for malicious content

Patch Information

At the time of publication, the vendor (kalcaddle) has not responded to disclosure attempts and no official patch is available. Users should monitor the official kodbox repository for security updates. Until an official fix is released, implementing workarounds and compensating controls is strongly recommended.

Relevant vulnerability tracking information is available at VulDB #353127 and VulDB Submission #775479.

Workarounds

Disable public sharing functionality by modifying the application configuration or removing access to the userShare.class.php controller
Implement strict file type validation at the web server level to reject executable files
Configure upload directories with restrictive permissions to prevent script execution
Place vulnerable kodbox instances behind VPN or authentication gateway to limit exposure

bash

# Configuration example - Restrict executable uploads in Apache
<Directory "/path/to/kodbox/data">
    # Deny execution of scripts in upload directories
    <FilesMatch "\.(php|phtml|php5|php7|asp|aspx|cgi|pl|py)$">
        Deny from all
    </FilesMatch>
    # Alternative for Apache 2.4+
    # Require all denied
</Directory>