CVE-2026-18720

Executive Summary

CVE-2026-18720 is a critical improper authorization vulnerability (CWE-266) discovered in kalcaddle kodbox version 1.67 Build 02, specifically within the msgWarning Plugin component. The flaw resides in the file /index.php?plugin/msgWarning/action and allows remote, unauthenticated attackers to bypass authorization checks and access restricted functionality or data. The exploit has been publicly published and may already be deployed in the wild. The vendor was contacted early about the disclosure but has not responded, leaving the product in an unpatched state. With a CVSS score of 5.3 (Medium), the vulnerability exposes confidentiality by allowing unauthorized information disclosure.

Technical Analysis

The vulnerability affects kodbox 1.67 Build 02, specifically the msgWarning plugin. The vulnerable endpoint is /index.php?plugin/msgWarning/action, which processes incoming requests for warning message functionality. The flaw is classified as CWE-266: Incorrect Privilege Assignment, indicating that the software assigns privileges, rights, or permissions to an actor in a manner that allows that actor to execute operations or access resources for which it is not authorized.

Attack Surface and Mechanism:

The msgWarning plugin is a component of kodbox (formerly kodexplorer), a popular open-source web-based file manager and document management system. The plugin exposes an action handler at index.php with the plugin parameter set to msgWarning. The vulnerability arises because the plugin's action handler fails to properly authenticate or authorize the requesting user before processing the action.

The underlying flaw is characteristic of many PHP-based web applications where access control checks are either absent, incomplete, or implemented only within certain controller/action paths. In this case, the msgWarning plugin's action method likely retrieves message/warning data without verifying that:

1. The session is authenticated.
2. The user has the required role/permission (e.g., admin) to access the message warning panel.
3. The request originates from an authorized IP or contains proper CSRF tokens.

The vulnerability is remotely exploitable (AV:N), requires no authentication (PR:N), no user interaction (UI:N), and no special conditions (AC:L) other than network access. The impact is limited to confidentiality (C:L) — an attacker can potentially read warning messages, system notifications, or internal configuration data exposed through this endpoint. The integrity and availability are not impacted (I:N, A:N).

Code-Level Analysis (based on vulnerability class patterns):

While specific source code for this version is not fully disclosed, typical vulnerable implementations in such plugins follow a pattern:

<?php
// /plugins/msgWarning/action.php
class msgWarningPlugin {
    public function action() {
        // VULNERABILITY: no session check, no permission check
        $warningData = $this->getWarnings();
        echo json_encode($warningData);
    }
}

The absence of session_start(), login_status_check(), check_permission(), or similar authorization guards at the beginning of the method allows unauthenticated remote requests to reach and execute the handler. Attackers can simply craft an HTTP GET/POST request to /index.php?plugin/msgWarning/action and receive the response containing sensitive data.

Exploitation Scenarios

Attack Chain — Unauthenticated Data Exfiltration via msgWarning Plugin:

Step 1: Reconnaissance and Target Identification

The attacker begins by scanning for internet-facing kalcaddle kodbox deployments. Shodan dorks and search engine queries help identify targets:

• app:"KodBox" or product:"kalcaddle kodbox"
• GUI fingerprinting: kodbox typically presents a login page at /index.php with distinctive Kodexplorer/kodbox branding. The attacker probes multiple targets.

Step 2: Endpoint Discovery and Version Fingerprinting

The attacker sends a request to confirm the exact version:

GET /index.php?user/login HTTP/1.1
Host: target.com

Responses or the HTML source may reveal version 1.67 Build 02. Alternatively, the attacker accesses data/version.json or similar files if directory listing is enabled.

Step 3: Triggering the Vulnerability (Weaponization)

The attacker crafts a direct request to the vulnerable endpoint:

GET /index.php?plugin/msgWarning/action HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: application/json, text/plain, */*

Since the vulnerability is unauthenticated and requires no special conditions, this single HTTP GET request is sufficient to trigger the flaw. The plugin parameter directs the application's plugin architecture to load the msgWarning plugin, and the action parameter invokes the default action method without authorization checks.

Step 4: Payload Execution / Data Retrieval

The server processes the request and returns the warning message data in the HTTP response body. This may include:

• Internal system warnings and error messages.
• Administrative notifications.
• File system status information.
• Potentially sensitive configuration details transmitted within the messages.
• SMTP/email server credentials if included in warning content.

The attacker captures the response:

{
  "status": "success",
  "data": {
    "warnings": [
      {"type": "disk_usage", "message": "Disk usage exceeded 90% on /dev/sda1"},
      {"type": "login_alert", "message": "Failed login attempt from IP 203.0.113.5"}
    ],
    "admin_notes": "SMTP password: Smtp@dmin2026"
  }
}

Step 5: Post-Exploitation and Impact Expansion

The attacker uses the disclosed information to escalate further:

• If admin credentials or SMTP passwords are leaked, attempt login to the admin panel.
• Use leaked internal IP addresses and network topology for lateral movement.
• Combine with other exposed endpoints to enumerate additional plugins.
• The attacker may also probe other plugins (e.g., /index.php?plugin/xxx/action) since the authorization flaw might be systemic across multiple components.

Because the endpoint is unauthenticated and remotely accessible, the attacker can repeat the request at will, continuously monitoring internal state changes.

Impact Assessment

CVSS Subscore Analysis: The base score of 5.3 (Medium) reflects the following:

• Attack Vector (AV:N): The vulnerability is remotely exploitable over the network without any physical or local access requirements.
• Attack Complexity (AC:L): No special conditions, race conditions, or configuration dependencies are needed; a simple crafted request triggers the flaw.
• Privileges Required (PR:N): No authentication is required — the most severe scenario from a privilege perspective.
• User Interaction (UI:N): No victim interaction is needed, enabling fully automated attack campaigns.
• Confidentiality Impact (C:L): The attack leads to unauthorized disclosure of information, limited in scope but reaching internal system data.

Business Impact:

• Information Disclosure: Warning messages and plugin data may contain sensitive operational details, internal IP schemas, security alerts, and potentially credentials, leading to downstream compromise.
• Security Posture Degradation: Knowledge of internal monitoring/alerts allows attackers to time their intrusions to avoid detection (e.g., by evading during maintenance windows).
• Reputation Damage: If exploited publicly (e.g., ransomware groups using it for recon), customer trust erodes.
• Regulatory Exposure: In regulated industries, data leakage — even of operational messages — can trigger breach notification obligations if classified as personal or sensitive data.

Affected Systems and Blast Radius:

• All deployments of kalcaddle kodbox version 1.67 Build 02 are vulnerable.
• Given that kodbox is a PHP application often deployed on shared hosting, VPS, and NAS devices, the blast radius spans small-to-medium businesses, educational institutions, and hobbyist deployments globally.
• Older versions may also be affected if the pattern persists across the codebase, though the CVE confirms only 1.67 Build 02.

Exploit Publicity: A published exploit amplifies the risk. The existence of a proof-of-concept means even low-skilled attackers can use the exploit against vulnerable targets, increasing the likelihood of mass exploitation campaigns.

Detection Guidance

Sigma Rule

title: Detecting Exploitation of CVE-2026-18720 in kodbox msgWarning Plugin
id: 6f2a1c1e-9c41-4a2a-ae92-20fb8fc4d764
status: experimental
description: Detects unauthenticated HTTP requests targeting the vulnerable msgWarning plugin action endpoint in kalcaddle kodbox
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18720
author: Valtersit Threat Intel
date: 2026/03/13
logsource:
    category: webserver
    product: apache
    definition: 'Requirements: web server access logs with full URI and user-agent'
detection:
    selection:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - 'plugin/msgWarning/action'
        cs-user-agent:
            - '*'
    condition: selection
    timeframe: 60s
falsepositives:
    - Legitimate authenticated access to the msgWarning plugin by admins (rare)
level: high
fields:
    - c-ip
    - cs-uri-query
    - sc-status
    - cs-user-agent

YARA Rule

rule CVE_2026_18720_kodbox_msgWarning_exploit
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-03-13"
        description = "Detects HTTP requests attempting to exploit CVE-2026-18720 in kalcaddle kodbox msgWarning plugin"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18720"
        cve_id = "CVE-2026-18720"
        severity = "medium"
        nvd_cvss = "5.3"

    strings:
        $s1 = "/index.php?plugin/msgWarning/action" ascii wide nocase
        $s2 = "plugin=msgWarning" ascii wide nocase
        $s3 = "msgWarning" ascii wide nocase
        $s4 = "HTTP/1.1" ascii wide
        $s5 = "User-Agent" ascii wide nocase

    condition:
        uint16(0) == 0x3c21 and // "<!" for raw HTTP packets, treat as text
        filesize < 15000 and
        2 of ($s1, $s2, $s3) and
        $s4 and $s5
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Possible CVE-2026-18720 kodbox msgWarning Plugin Authorization Bypass"; flow:established,to_server; content:"GET"; http_method; content:"/index.php"; http_uri; content:"plugin"; http_uri; content:"msgWarning"; http_uri; content:"action"; http_uri; pcre:"/\/index\.php\?plugin\/msgWarning\/action/iU"; reference:cve,2026-18720; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-18720; classtype:attempted-recon; sid:2026018720; rev:1; metadata:created_at 2026_03_13, updated_at 2026_03_13, cve CVE-2026-18720;

Elastic Detection

any where
  process.name == "httpd" or event.action == "request" or
  (event.module == "apache" and event.dataset == "apache.access")
  and url.path == "/index.php"
  and url.query contains "plugin/msgWarning/action"
  and not user.name == "admin"  // adjust if needed; unauthenticated by default

Splunk SPL Query

index=web* sourcetype=access_combined
| where like(cs_uri_query, "%plugin/msgWarning/action%")
| table _time, clientip, method, cs_uri_query, status, useragent
| stats count by clientip, method, cs_uri_query, status, useragent
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web_application, kodbox,">
  <rule id="100621" level="12">
    <decoded>
      <field name="url">/index.php?plugin/msgWarning/action</field>
    </decoded>
    <description>Kodbox msgWarning plugin CVE-2026-18720 authorization bypass attempt detected</description>
    <group>attack, cve</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-18720</info>
    <info type="link">https://nvd.nist.gov/vuln/detail/CVE-2026-18720</info>
    <info type="os">linux</info>
    <info type="app">apache, nginx</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor (kalcaddle) has not responded to disclosure and has not released a fixed version as of the report date.

1) Immediate Mitigations (to implement within 24-48 hours):

• Disable the msgWarning plugin: Access the kodbox admin panel, navigate to Plugin Management, and disable or uninstall the msgWarning plugin entirely. This removes the vulnerable endpoint from the attack surface.
• Block access at the WAF/Layer 7 firewall: Deploy a temporary WAF rule to block any URL containing plugin/msgWarning/action:

SecRule REQUEST_URI "@rx /index\.php\?plugin/msgWarning/action" \
    "id:100621,phase:1,deny,status:403,msg:'blocked CVE-2026-18720 exploitation attempt'"

• Restrict network access to the kodbox web interface: Place the management interface behind a VPN or firewall rule that only allows access from trusted administrative IP ranges, reducing the remote attack surface.
• Monitor and log all requests to /index.php?plugin=msgWarning: Implement additional logging to identify scanning or exploitation attempts; alert on repeated hits.

2) Patch/Upgrade Steps:

• As of this report, no patched version exists. Continuously monitor the official kalcaddle kodbox GitHub repository, the project's official website, and CVE feeds for a security advisory and patch release.
• If a patched version is released, upgrade immediately from 1.67 Build 02 to the latest stable version that addresses CWE-266 in the plugin architecture.
• Back up the database and configuration files before any upgrade.
• After patching, verify that the msgWarning plugin no longer responds to unauthenticated requests by testing the endpoint without a session cookie.

3) Long-term Hardening:

• Input/output validation review: Conduct a comprehensive security audit of all kodbox plugins for similar authorization bypass patterns. The vulnerability suggests systemic issues in the plugin framework's default authorization logic.
• Centralized authentication: If kodbox supports integration with external identity providers or SSO, enable it and enforce strict session management.
• Web Application Firewall (WAF) permanent rules: Deploy the WAF rule permanently — even after patching — to protect other plugin endpoints that may be overlooked.
• Regular vulnerability scanning: Integrate kodbox into the enterprise vulnerability management program, with weekly scans using tools like Nessus, OpenVAS, or Qualys.
• Stay informed: Subscribe to CVE alerts for all open-source dependencies in the deployment.
• Consider alternative products: If the vendor remains unresponsive, evaluate whether continuing to use kodbox is acceptable given its security posture; shortlist replacement file management tools.
• Monitor for exploit-in-the-wild activity: Given the published exploit, organizations should add URLs like /index.php?plugin/msgWarning/action to their threat intelligence platform watchlists and network detection rules.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18720 — National Vulnerability Database entry confirming the vulnerability details, CWE-266 classification, and CVSS vector.
2. CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-18720 — Official CVE record containing the description and CNA information.
3. kalcaddle/kodbox GitHub (Product Repository): https://github.com/kalcaddle/kodbox — The official source repository to monitor for patch releases and security advisories; no patch is currently available.
4. Exploit-DB (if applicable): https://www.exploit-db.com — The publishment of the exploit referenced in the CVE description; search for "kodbox msgWarning" entries (the exact DB ID is not confirmed in the CVE data).
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — As of this report, CVE-2026-18720 is not listed in the KEV. However, given the published exploit, the SOC should check this catalog daily for updates.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of the writing date, no specific threat actor campaign has been publicly attributed to CVE-2026-18720. However, the CVE description states "The exploit has been published and may be used." This indicates the PoC is publicly accessible, raising the probability of imminent automated exploitation by botnets or opportunistic attackers. Organizations running kodbox should treat this as an active rather than hypothetical threat.

Report generated: 2026-03-13 | Analyst: Valtersit Threat Intelligence Team | Classification: TLP:CLEAR