CVE-2026-8753

MEDIUM 6.3

kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection

CVSS Score

6.3

EPSS Score

0.8%

EPSS Percentile

75th

A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-77 CWE-74
Vendor	kalcaddle
Product	kodbox
Published	May 17, 2026
Last Updated	May 18, 2026

Stay Ahead of the Next One

Get instant alerts for kalcaddle kodbox

Be the first to know when new medium vulnerabilities affecting kalcaddle kodbox are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

kalcaddle / Kodbox

1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18 1.19 1.20 1.21 1.22 1.23 1.24 1.25 1.26 1.27 1.28 1.29 1.30 1.31 1.32 1.33 1.34 1.35 1.36 1.37 1.38 1.39 1.40 1.41 1.42 1.43 1.44 1.45 1.46 1.47 1.48 1.49 1.50 1.51 1.52 1.53 1.54 1.55 1.56 1.57 1.58 1.59 1.60 1.61 1.62 1.63 1.64

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/364380 vuldb.com: https://vuldb.com/vuln/364380/cti vuldb.com: https://vuldb.com/submit/810109 vulnplus-note.wetolink.com: https://vulnplus-note.wetolink.com/share/R0hHqwMywhsm

Credits

🔍 vulnplusbot (VulDB User) VulDB CNA Team