CVE-2026-8753

MEDIUM

kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-364380 | kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection
https://vuldb.com/vuln/364380
Signature, Permissions Required signature permissions-required
VDB-364380 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/364380/cti
Third Party Advisory third-party-advisory
Submit #810109 | Kodbox 1.64 Command Injection
https://vuldb.com/submit/810109

Scores

CVSS v3 6.3
EPSS 0.0118
EPSS Percentile 63.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (50)
kalcaddle/Kodbox 1.0
kalcaddle/Kodbox 1.1
kalcaddle/Kodbox 1.10
kalcaddle/Kodbox 1.11
kalcaddle/Kodbox 1.12
kalcaddle/Kodbox 1.13
kalcaddle/Kodbox 1.14
kalcaddle/Kodbox 1.15
kalcaddle/Kodbox 1.16
kalcaddle/Kodbox 1.17
... and 40 more
Published May 17, 2026
Tracked Since May 17, 2026