CVE-2026-5618 Overview
CVE-2026-5618 is a Server-Side Request Forgery (SSRF) vulnerability affecting kalcaddle kodbox up to version 1.64. The flaw resides in an unknown function of the shareMake/shareCheck component. Attackers can manipulate the siteFrom or siteTo arguments to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability is classified under CWE-918 (Server-Side Request Forgery). Exploitation occurs over the network without authentication, though the attack complexity is high. A public exploit exists, and the vendor did not respond to disclosure attempts.
Critical Impact
Unauthenticated remote attackers can abuse kodbox to issue server-side HTTP requests, enabling reconnaissance of internal networks and access to otherwise unreachable services.
Affected Products
- kalcaddle kodbox versions up to and including 1.64
- The shareMake/shareCheck component within kodbox
- Self-hosted kodbox deployments exposed to untrusted networks
Discovery Timeline
- 2026-04-06 - CVE-2026-5618 published to the National Vulnerability Database
- 2026-04-29 - CVE-2026-5618 last updated in the NVD database
Technical Details for CVE-2026-5618
Vulnerability Analysis
The vulnerability exists in the share-handling logic of kodbox, a web-based file management and collaboration platform. Specifically, the shareMake and shareCheck functions accept user-controllable siteFrom and siteTo parameters. These parameters are passed into server-side HTTP request operations without adequate validation of the destination address.
An attacker who controls these parameters can direct the kodbox server to send HTTP requests to arbitrary URLs. This includes internal IP ranges, loopback interfaces, and cloud metadata endpoints. The exploitability is reported as difficult, reflecting required preconditions in the request flow. However, a working public exploit is available, lowering the practical barrier for attackers.
Root Cause
The root cause is missing or insufficient validation of URL inputs supplied to share-creation and share-verification routines. The application trusts the supplied siteFrom/siteTo values and forwards them to an HTTP client. Without an allow-list of permitted hosts or a deny-list for internal address ranges, the server functions as an open proxy for attacker-directed requests.
Attack Vector
The attack is remote and unauthenticated. An attacker crafts a request to the shareMake or shareCheck endpoint with siteFrom or siteTo set to a target URL. The kodbox server then issues a request to that URL on the attacker's behalf. The response, error messages, or timing differences may be observed to map internal networks, enumerate services, or retrieve sensitive data from internal-only endpoints.
No verified proof-of-concept code is available from the references. Technical details are tracked on VulDB Vulnerability #355408 and the corresponding VulDB CTI report.
Detection Methods for CVE-2026-5618
Indicators of Compromise
- Outbound HTTP requests from kodbox server processes to internal IP ranges such as 127.0.0.1, 169.254.169.254, or RFC1918 addresses
- Web server access logs showing requests to shareMake or shareCheck endpoints containing siteFrom or siteTo parameters with unusual URL values
- Unexpected DNS lookups originating from the kodbox host targeting attacker-controlled domains
- Spikes in server-initiated connections following requests to share-related endpoints
Detection Strategies
- Inspect web access logs for requests to share endpoints where siteFrom or siteTo values reference internal hostnames, IP literals, or cloud metadata services
- Correlate inbound HTTP requests to kodbox with subsequent outbound traffic from the same process to identify SSRF chains
- Deploy egress monitoring on the kodbox host and flag connections that bypass expected destination patterns
Monitoring Recommendations
- Forward kodbox application and web server logs to a centralized SIEM for retention and search
- Monitor for connections from kodbox to cloud instance metadata endpoints (169.254.169.254)
- Alert on any successful authentication or token retrieval events originating from the kodbox host that were not initiated by an administrator
How to Mitigate CVE-2026-5618
Immediate Actions Required
- Restrict network egress from the kodbox server to only the destinations required for legitimate operation
- Place kodbox behind a web application firewall (WAF) with rules to inspect and filter siteFrom and siteTo parameter values
- Disable or block access to the shareMake and shareCheck endpoints if the share functionality is not required
- Audit recent logs for evidence of SSRF probing against internal infrastructure
Patch Information
No vendor patch is referenced in the available advisories. According to the disclosure, the vendor was contacted but did not respond. Operators should monitor the kodbox project for any future security updates and review the VulDB entry for status changes.
Workarounds
- Configure host-based firewall rules to deny outbound traffic from kodbox to private IP ranges and cloud metadata IPs
- Run kodbox in a network segment that cannot reach sensitive internal services or identity endpoints
- Implement reverse proxy filtering to reject requests where share parameters contain internal addresses, loopback references, or non-HTTP schemes
# Example iptables egress restriction for the kodbox host
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
