CVE-2026-5618

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5618", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-05T15:44:09.915Z", "datePublished": "2026-04-06T03:30:19.889Z", "dateUpdated": "2026-04-06T15:02:04.870Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T03:30:19.889Z"}, "title": "kalcaddle kodbox shareMake/shareCheck server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "kalcaddle", "product": "kodbox", "versions": [{"version": "1.0", "status": "affected"}, {"version": "1.1", "status": "affected"}, {"version": "1.2", "status": "affected"}, {"version": "1.3", "status": "affected"}, {"version": "1.4", "status": "affected"}, {"version": "1.5", "status": "affected"}, {"version": "1.6", "status": "affected"}, {"version": "1.7", "status": "affected"}, {"version": "1.8", "status": "affected"}, {"version": "1.9", "status": "affected"}, {"version": "1.10", "status": "affected"}, {"version": "1.11", "status": "affected"}, {"version": "1.12", "status": "affected"}, {"version": "1.13", "status": "affected"}, {"version": "1.14", "status": "affected"}, {"version": "1.15", "status": "affected"}, {"version": "1.16", "status": "affected"}, {"version": "1.17", "status": "affected"}, {"version": "1.18", "status": "affected"}, {"version": "1.19", "status": "affected"}, {"version": "1.20", "status": "affected"}, {"version": "1.21", "status": "affected"}, {"version": "1.22", "status": "affected"}, {"version": "1.23", "status": "affected"}, {"version": "1.24", "status": "affected"}, {"version": "1.25", "status": "affected"}, {"version": "1.26", "status": "affected"}, {"version": "1.27", "status": "affected"}, {"version": "1.28", "status": "affected"}, {"version": "1.29", "status": "affected"}, {"version": "1.30", "status": "affected"}, {"version": "1.31", "status": "affected"}, {"version": "1.32", "status": "affected"}, {"version": "1.33", "status": "affected"}, {"version": "1.34", "status": "affected"}, {"version": "1.35", "status": "affected"}, {"version": "1.36", "status": "affected"}, {"version": "1.37", "status": "affected"}, {"version": "1.38", "status": "affected"}, {"version": "1.39", "status": "affected"}, {"version": "1.40", "status": "affected"}, {"version": "1.41", "status": "affected"}, {"version": "1.42", "status": "affected"}, {"version": "1.43", "status": "affected"}, {"version": "1.44", "status": "affected"}, {"version": "1.45", "status": "affected"}, {"version": "1.46", "status": "affected"}, {"version": "1.47", "status": "affected"}, {"version": "1.48", "status": "affected"}, {"version": "1.49", "status": "affected"}, {"version": "1.50", "status": "affected"}, {"version": "1.51", "status": "affected"}, {"version": "1.52", "status": "affected"}, {"version": "1.53", "status": "affected"}, {"version": "1.54", "status": "affected"}, {"version": "1.55", "status": "affected"}, {"version": "1.56", "status": "affected"}, {"version": "1.57", "status": "affected"}, {"version": "1.58", "status": "affected"}, {"version": "1.59", "status": "affected"}, {"version": "1.60", "status": "affected"}, {"version": "1.61", "status": "affected"}, {"version": "1.62", "status": "affected"}, {"version": "1.63", "status": "affected"}, {"version": "1.64", "status": "affected"}], "modules": ["shareMake/shareCheck"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.6, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-05T17:49:14.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "vulnplusbot (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/355408", "name": "VDB-355408 | kalcaddle kodbox shareMake/shareCheck server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/355408/cti", "name": "VDB-355408 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/785572", "name": "Submit #785572 | Kodbox 1.64 SSRF", "tags": ["third-party-advisory"]}, {"url": "https://vulnplus-note.wetolink.com/share/3VtzyzYgcS4b", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T15:01:55.554157Z", "id": "CVE-2026-5618", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:02:04.870Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5618", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:01:55.554157Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:01:59.664Z"}}], "cna": {"title": "kalcaddle kodbox shareMake/shareCheck server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "vulnplusbot (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "kalcaddle", "modules": ["shareMake/shareCheck"], "product": "kodbox", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "1.2"}, {"status": "affected", "version": "1.3"}, {"status": "affected", "version": "1.4"}, {"status": "affected", "version": "1.5"}, {"status": "affected", "version": "1.6"}, {"status": "affected", "version": "1.7"}, {"status": "affected", "version": "1.8"}, {"status": "affected", "version": "1.9"}, {"status": "affected", "version": "1.10"}, {"status": "affected", "version": "1.11"}, {"status": "affected", "version": "1.12"}, {"status": "affected", "version": "1.13"}, {"status": "affected", "version": "1.14"}, {"status": "affected", "version": "1.15"}, {"status": "affected", "version": "1.16"}, {"status": "affected", "version": "1.17"}, {"status": "affected", "version": "1.18"}, {"status": "affected", "version": "1.19"}, {"status": "affected", "version": "1.20"}, {"status": "affected", "version": "1.21"}, {"status": "affected", "version": "1.22"}, {"status": "affected", "version": "1.23"}, {"status": "affected", "version": "1.24"}, {"status": "affected", "version": "1.25"}, {"status": "affected", "version": "1.26"}, {"status": "affected", "version": "1.27"}, {"status": "affected", "version": "1.28"}, {"status": "affected", "version": "1.29"}, {"status": "affected", "version": "1.30"}, {"status": "affected", "version": "1.31"}, {"status": "affected", "version": "1.32"}, {"status": "affected", "version": "1.33"}, {"status": "affected", "version": "1.34"}, {"status": "affected", "version": "1.35"}, {"status": "affected", "version": "1.36"}, {"status": "affected", "version": "1.37"}, {"status": "affected", "version": "1.38"}, {"status": "affected", "version": "1.39"}, {"status": "affected", "version": "1.40"}, {"status": "affected", "version": "1.41"}, {"status": "affected", "version": "1.42"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.46"}, {"status": "affected", "version": "1.47"}, {"status": "affected", "version": "1.48"}, {"status": "affected", "version": "1.49"}, {"status": "affected", "version": "1.50"}, {"status": "affected", "version": "1.51"}, {"status": "affected", "version": "1.52"}, {"status": "affected", "version": "1.53"}, {"status": "affected", "version": "1.54"}, {"status": "affected", "version": "1.55"}, {"status": "affected", "version": "1.56"}, {"status": "affected", "version": "1.57"}, {"status": "affected", "version": "1.58"}, {"status": "affected", "version": "1.59"}, {"status": "affected", "version": "1.60"}, {"status": "affected", "version": "1.61"}, {"status": "affected", "version": "1.62"}, {"status": "affected", "version": "1.63"}, {"status": "affected", "version": "1.64"}]}], "timeline": [{"lang": "en", "time": "2026-04-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-05T17:49:14.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/355408", "name": "VDB-355408 | kalcaddle kodbox shareMake/shareCheck server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/355408/cti", "name": "VDB-355408 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/785572", "name": "Submit #785572 | Kodbox 1.64 SSRF", "tags": ["third-party-advisory"]}, {"url": "https://vulnplus-note.wetolink.com/share/3VtzyzYgcS4b", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-06T03:30:19.889Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5618", "state": "PUBLISHED", "dateUpdated": "2026-04-06T15:02:04.870Z", "dateReserved": "2026-04-05T15:44:09.915Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-06T03:30:19.889Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["shareMake/shareCheck"], "product": "kodbox", "vendor": "kalcaddle", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "1.2"}, {"status": "affected", "version": "1.3"}, {"status": "affected", "version": "1.4"}, {"status": "affected", "version": "1.5"}, {"status": "affected", "version": "1.6"}, {"status": "affected", "version": "1.7"}, {"status": "affected", "version": "1.8"}, {"status": "affected", "version": "1.9"}, {"status": "affected", "version": "1.10"}, {"status": "affected", "version": "1.11"}, {"status": "affected", "version": "1.12"}, {"status": "affected", "version": "1.13"}, {"status": "affected", "version": "1.14"}, {"status": "affected", "version": "1.15"}, {"status": "affected", "version": "1.16"}, {"status": "affected", "version": "1.17"}, {"status": "affected", "version": "1.18"}, {"status": "affected", "version": "1.19"}, {"status": "affected", "version": "1.20"}, {"status": "affected", "version": "1.21"}, {"status": "affected", "version": "1.22"}, {"status": "affected", "version": "1.23"}, {"status": "affected", "version": "1.24"}, {"status": "affected", "version": "1.25"}, {"status": "affected", "version": "1.26"}, {"status": "affected", "version": "1.27"}, {"status": "affected", "version": "1.28"}, {"status": "affected", "version": "1.29"}, {"status": "affected", "version": "1.30"}, {"status": "affected", "version": "1.31"}, {"status": "affected", "version": "1.32"}, {"status": "affected", "version": "1.33"}, {"status": "affected", "version": "1.34"}, {"status": "affected", "version": "1.35"}, {"status": "affected", "version": "1.36"}, {"status": "affected", "version": "1.37"}, {"status": "affected", "version": "1.38"}, {"status": "affected", "version": "1.39"}, {"status": "affected", "version": "1.40"}, {"status": "affected", "version": "1.41"}, {"status": "affected", "version": "1.42"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.46"}, {"status": "affected", "version": "1.47"}, {"status": "affected", "version": "1.48"}, {"status": "affected", "version": "1.49"}, {"status": "affected", "version": "1.50"}, {"status": "affected", "version": "1.51"}, {"status": "affected", "version": "1.52"}, {"status": "affected", "version": "1.53"}, {"status": "affected", "version": "1.54"}, {"status": "affected", "version": "1.55"}, {"status": "affected", "version": "1.56"}, {"status": "affected", "version": "1.57"}, {"status": "affected", "version": "1.58"}, {"status": "affected", "version": "1.59"}, {"status": "affected", "version": "1.60"}, {"status": "affected", "version": "1.61"}, {"status": "affected", "version": "1.62"}, {"status": "affected", "version": "1.63"}, {"status": "affected", "version": "1.64"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en kalcaddle kodbox hasta la versi\u00f3n 1.64. Esto afecta una funci\u00f3n desconocida del componente shareMake/shareCheck. Realizar una manipulaci\u00f3n del argumento siteFrom/siteTo resulta en falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque es posible de llevar a cabo de forma remota. La complejidad de un ataque es bastante alta. La explotabilidad se reporta como dif\u00edcil. El exploit es ahora p\u00fablico y puede ser usado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-5618", "lastModified": "2026-07-24T09:10:00.153", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5618", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T15:01:55.554157Z", "version": "2.0.3"}}]}, "published": "2026-04-06T04:16:14.050", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/785572"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355408"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/355408/cti"}, {"source": "cna@vuldb.com", "url": "https://vulnplus-note.wetolink.com/share/3VtzyzYgcS4b"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.23"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.24"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.26"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.27"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.28"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.29"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.30"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.31"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.32"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.33"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.34"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.35"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.36"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.37"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.38"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.39"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.40"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.41"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.42"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.43"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.44"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.45"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.46"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.47"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.48"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.49"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.50"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.51"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.52"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.53"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.54"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.55"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.56"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.57"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.58"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.59"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.60"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.61"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.62"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.63"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.64"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kodbox", "source": "cna", "vendor": "kalcaddle"}, "product": "kodbox", "vendor": "kalcaddle"}], "analysis": {"en": {"generated_at": "2026-04-06T06:20:27.098262+00:00", "value": {"mitigation_remediation": ["Check for and apply any kalcaddle kodbox updates that address the SSRF issue, such as a release newer than 1.64.", "If no official patch is available, restrict outbound traffic from the kodbox instance to only trusted networks by configuring firewall or proxy rules.", "Validate and whitelist all URLs supplied to the siteFrom and siteTo parameters before they are processed by the application to prevent unauthorized requests.", "Contact kalcaddle for further guidance or to confirm when a vendor patch will be released."], "summary": {"action": "Patch Now", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The affected vendor is kalcaddle and the product is kodbox. Versions affected include all releases up to and including 1.64. No specific sub\u2011version or patch details are provided in the advisories.", "description_and_impact": "A server\u2011side request forgery flaw exists in the shareMake/shareCheck component of kalcaddle kodbox up to version 1.64. By manipulating the siteFrom and siteTo arguments, an attacker can cause the server to initiate requests to arbitrary URLs, potentially accessing internal resources, exfiltrating data, or performing further malicious actions. The vulnerability allows remote exploitation, though the attack complexity is described as high and exploitation as difficult. However, public exploits are available, indicating that the flaw is being actively used.", "risk_and_exploitability": "The CVSS base score of 6.3 places the vulnerability in the medium severity range. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no widespread, known exploitation yet. Given the public availability of exploits and remote nature of the attack, the risk remains significant. The attack vector is inferred to be purely remote, relying on the server\u2019s ability to reach arbitrary URLs passed by user input."}}}}, "created": "2026-04-06T20:15:12.478811+00:00", "updated": "2026-04-06T21:47:29.445916+00:00", "vendors": ["kalcaddle", "kalcaddle$PRODUCT$kodbox"]}