PT-2026-41543 · Kodbox · Filethumb Plugin+1

Vulnplusbot · Published 2026-05-17 · Updated 2026-05-18 · CVE-2026-8753

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions kalcaddle Kodbox versions prior to 1.65

Description Command injection is possible via remote attack in the fileThumb Plugin. The issue exists within the parseVideoInfo() function located in the /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php file, where improper manipulation of the ffmpegBin argument allows for the execution of arbitrary commands.

Recommendations Update to a version later than 1.64. As a temporary workaround, restrict access to the fileThumb Plugin or the parseVideoInfo() function to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-8753

Affected Products

Kodbox

Filethumb Plugin

References · 7

• 🔥 https://vulnplus-note.wetolink.com/share/R0hHqwMywhsm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8753 · Security Note
• https://twitter.com/CVEnew/status/2056253297615421554 · Twitter Post
• https://t.me/CVEtracker/54065 · Telegram Post
• https://vuldb.com/vuln/364380/cti · Note
• https://vuldb.com/submit/810109 · Note
• https://vuldb.com/vuln/364380 · Note