CVE-2026-4589: kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery
A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4589?
CVE-2026-4589 is classified as a medium severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2026-4589?
To fix CVE-2026-4589, update to the latest version of kalcaddle kodbox that addresses this vulnerability.
What component is affected by CVE-2026-4589?
The CVE-2026-4589 vulnerability affects the PathDriverUrl function in the editor.class.php file of kalcaddle kodbox.
What types of attacks can CVE-2026-4589 enable?
CVE-2026-4589 can enable server-side request forgery attacks that may lead to unauthorized access of internal resources.
Which version of kalcaddle kodbox is vulnerable to CVE-2026-4589?
The vulnerable version of kalcaddle kodbox is 1.64.