This vulnerability affects kalcaddle kodbox 1.64 in the PathDriverUrl function of /workspace/source-code/app/controller/explorer/editor.class.php. By manipulating the 'path' argument in the fileGet endpoint, an attacker can cause the server to make unintended requests, characteristic of SSRF. The issue is remotely exploitable without user interaction and requires low privileges. The vendor was notified but did not respond or release a patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to induce the server to make arbitrary requests, potentially accessing internal resources or services not otherwise reachable. The impact is rated medium due to limited confidentiality, integrity, and availability consequences as per the CVSS vector. No known exploits in the wild have been reported yet.

No official patch or fix is currently available, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates. Until a fix is released, consider implementing network-level controls to restrict the server's outbound requests to trusted destinations to mitigate SSRF risks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.