CVE-2025-10233
kalcaddle kodbox editor.class.php fileSave path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 10, 2025
- Updated
- Sep 11, 2025
- Reserved
- Sep 10, 2025
Description
A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
kodboxkalcaddle |
|
References
- VDB-323502 | kalcaddle kodbox editor.class.php fileSave path traversalvdb-entrytechnical-description
- VDB-323502 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #641755 | kalcaddle kodbox V1.61.09 Arbitrary File Write RCEthird-party-advisory
- Submit #641757 | kalcaddle kodbox V1.61.09 Arbitrary File Read (Duplicate)third-party-advisory
- https://github.com/August829/Yu/blob/main/58ead8e7e08bfb012.mdrelated
- https://github.com/August829/Yu/blob/main/58ead8e7e08bfb011.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.