CVE-2025-11016 | kalcaddle kodbox up to 1.61.09 index.class.php fileOut path path traversal

A vulnerability labeled as critical has been found in kalcaddle kodbox up to 1.61.09. The affected element is the function fileOut of the file app/controller/explorer/index.class.php. Such manipulation of the argument path leads to path traversal.

This vulnerability is listed as CVE-2025-11016. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.