A server‑side request forgery flaw exists in the shareMake/shareCheck component of kalcaddle kodbox up to version 1.64. By manipulating the siteFrom and siteTo arguments, an attacker can cause the server to initiate requests to arbitrary URLs, potentially accessing internal resources, exfiltrating data, or performing further malicious actions. The vulnerability allows remote exploitation, though the attack complexity is described as high and exploitation as difficult. However, public exploits are available, indicating that the flaw is being actively used.

The affected vendor is kalcaddle and the product is kodbox. Versions affected include all releases up to and including 1.64. No specific sub‑version or patch details are provided in the advisories.

The CVSS base score of 6.3 places the vulnerability in the medium severity range. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no widespread, known exploitation yet. Given the public availability of exploits and remote nature of the attack, the risk remains significant. The attack vector is inferred to be purely remote, relying on the server’s ability to reach arbitrary URLs passed by user input.