Medium severity · published May 17, 2026
CVE-2026-8753
kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection
6.3
CVSS
1.9%
EPSS
No
On KEV
Description
A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
Kodbox · kalcaddle
1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +34 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8753
vuldb.com
https://vuldb.com/submit/810109
vuldb.com
https://vuldb.com/vuln/364380
vuldb.com
https://vuldb.com/vuln/364380/cti
vulnplus-note.wetolink.com
https://vulnplus-note.wetolink.com/share/R0hHqwMywhsm
More from Kodbox
9.8
CVE-2023-6849
kalcaddle kodbox app.php cover server-side request forgery
9.8
CVE-2023-6848
kalcaddle kodbox index.class.php check command injection
8.8
CVE-2026-1066
kalcaddle kodbox Compression zip command injection
6.3
CVE-2026-4589
kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery
6.3
CVE-2026-2560
kalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injection