Executive Summary

CVE-2026-4831 is a security flaw in kodbox, an open-source file management system, specifically in the Password-protected Share Handler component. The vulnerability exists in the function can() within the file auth.class.php. It allows authenticated collaborators to bypass folder password protection on shared folders by exploiting how internal share paths are handled in the authorization logic.

The root cause is that while folder password protection is enforced on folder listing operations, it is not enforced on direct file access operations for shared items. This means a collaborator who does not know the folder password can still directly download files inside the shared folder, bypassing the password check.

Technically, when the path type is a share item, the function returns immediately after a share check, skipping subsequent password and safe-box checks that are only applied to non-share paths. This leads to a bypass of the intended folder password protection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files within password-protected shared folders. Collaborators who have share access but do not know the folder password can still directly download files, bypassing the folder password protection.

This results in exposure of confidential or sensitive data that was intended to be protected by folder passwords. Additionally, the user interface and API misleadingly indicate that folder password protection is enforced, which can give a false sense of security.

The vulnerability also suggests potential similar bypasses in other read operations, increasing the risk of data leakage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing whether folder password protection is properly enforced on direct file access endpoints for shared folders.

Specifically, you can attempt to list the contents of a password-protected shared folder and then try to directly download a file inside that folder without providing the folder password.

If the folder listing endpoint returns an empty list or a password prompt, but the direct file download endpoint returns the file content without requiring a password, the vulnerability is present.

Suggested commands (replace placeholders accordingly):

• List folder contents (should require password): curl -X GET "http://<host>/?explorer/list/path&path={shareItem:<shareID>}/<folderSourceID>/&accessToken=<viewer_token>"
• Attempt direct file download (should require password but does not): curl -X GET "http://<host>/?explorer/index/fileOut&path={shareItem:<shareID>}/<fileSourceID>&accessToken=<viewer_token>"

If the second command returns the file content without prompting for a password, it confirms the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Modify the authorization logic in the file auth.class.php, specifically in the can() function, to ensure that folder password and safe-box checks are enforced on all file access operations, including direct file downloads for shared folders.
• Centralize folder password enforcement in a pre-read guard that applies to all relevant endpoints such as fileOut, fileGet, and zipDownload to prevent bypasses.
• Update UI and API messages to accurately reflect the security enforcement status, avoiding misleading indications that folder password protection is applied when it is not.
• If a patch or update is available from the vendor or community, apply it promptly.

Since the vendor did not respond to the disclosure, consider restricting access to shared folders or disabling password-protected shares until a fix is implemented.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated collaborators to bypass folder password protection on shared folders, exposing sensitive files without proper authorization.

Such unauthorized access to sensitive data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

The misleading UI and API messages that suggest folder password protection is enforced, while direct file access is unprotected, increase the risk of accidental data exposure and audit failures.

Useful 0 Not Useful 0