ByteOS Network

CVE Vulnerability Details :

CVE-2026-8753

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-17 May, 2026 | 12:00

Updated At-18 May, 2026 | 20:05

▼CVE Numbering Authority (CNA)

kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection

A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Products

Vendor

kalcaddle

Product

Kodbox

CPEs

cpe:2.3:a:kalcaddle:kodbox:*:*:*:*:*:*:*:*

Modules

fileThumb Plugin

Versions

Affected

1.0
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.10
1.11
1.12
1.13
1.14
1.15
1.16
1.17
1.18
1.19
1.20
1.21
1.22
1.23
1.24
1.25
1.26
1.27
1.28
1.29
1.30
1.31
1.32
1.33
1.34
1.35
1.36
1.37
1.38
1.39
1.40
1.41
1.42
1.43
1.44
1.45
1.46
1.47
1.48
1.49
1.50
1.51
1.52
1.53
1.54
1.55
1.56
1.57
1.58
1.59
1.60
1.61
1.62
1.63
1.64

Problem Types

Type	CWE ID	Description
CWE	CWE-77	Command Injection
CWE	CWE-74	Injection

Type: CWE

CWE ID: CWE-77

Description: Command Injection

Type: CWE

CWE ID: CWE-74

Description: Injection

Metrics

Version	Base score	Base severity	Vector
4.0	5.3	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
3.0	6.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
2.0	6.5	N/A	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Version: 4.0

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Version: 3.0

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Version: 2.0

Base score: 6.5

Base severity: N/A

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Credits

reporter

vulnplusbot (VulDB User)

coordinator

VulDB CNA Team

Timeline

Event	Date
Advisory disclosed	2026-05-16 00:00:00
VulDB entry created	2026-05-16 02:00:00
VulDB entry last update	2026-05-16 18:28:14

Event: Advisory disclosed

Date: 2026-05-16 00:00:00

Event: VulDB entry created

Date: 2026-05-16 02:00:00

Event: VulDB entry last update

Date: 2026-05-16 18:28:14

References

Hyperlink	Resource
https://vuldb.com/vuln/364380	vdb-entry technical-description
https://vuldb.com/vuln/364380/cti	signature permissions-required
https://vuldb.com/submit/810109	third-party-advisory
https://vulnplus-note.wetolink.com/share/R0hHqwMywhsm	exploit

Hyperlink: https://vuldb.com/vuln/364380

Resource:

vdb-entry

technical-description

Hyperlink: https://vuldb.com/vuln/364380/cti

Resource:

signature

permissions-required

Hyperlink: https://vuldb.com/submit/810109

Resource:

third-party-advisory

Hyperlink: https://vulnplus-note.wetolink.com/share/R0hHqwMywhsm

Resource:

exploit

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References