PT-2026-27143 · Kalcaddle+1 · Filethumb+1

Vuldb + 1 · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-4591

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions kalcaddle kodbox version 1.64

Description A weakness exists in kalcaddle kodbox that allows for os command injection. This occurs through manipulation of the checkBin function within the /workspace/source-code/plugins/fileThumb/app.php file of the fileThumb component. The attack can be executed remotely. The exploit has been publicly released. The vendor was contacted regarding this issue but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-4591

Affected Products

Filethumb

Kalcaddle Kodbox

References · 7

• 🔥 https://vulnplus-note.wetolink.com/share/3ml5XA0firIa · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4591 · Security Note
• https://twitter.com/cyberbivash/status/2036126640103739510 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2036178300343607466 · Twitter Post
• https://vuldb.com/?submit.775470 · Note
• https://vuldb.com/?ctiid.352427 · Note
• https://vuldb.com/?id.352427 · Note