CVE-2026-8753: kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection
A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
kalcaddle Kodbox fileThumb Pluginfrom your environment.Uninstall the fileThumb plugin (contains VideoResize.class.php) from affected Kodbox installations if the plugin is not required.
- Configuration
Disable the fileThumb plugin in Kodbox (contains VideoResize.class.php parseVideoInfo) to prevent remote command injection via the ffmpegBin argument.
fileThumb Plugin (kalcaddle Kodbox) enabled = false - Compensating control
Restrict external access to the Kodbox instance (for example, using firewall rules, WAF, or network ACLs to allow only trusted IPs) and block access to endpoints that may invoke fileThumb parseVideoInfo until a vendor-provided fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8753?
CVE-2026-8753 is classified as a critical vulnerability due to its potential for command injection.
How do I fix CVE-2026-8753?
To fix CVE-2026-8753, upgrade to the latest version of kalcaddle Kodbox beyond 1.64.
What are the potential impacts of CVE-2026-8753?
The impact of CVE-2026-8753 includes unauthorized command execution on affected systems.
Who is affected by CVE-2026-8753?
Users of kalcaddle Kodbox and the Kodbox fileThumb Plugin, versions up to 1.64, are affected by CVE-2026-8753.
What components are involved in CVE-2026-8753?
CVE-2026-8753 involves the parseVideoInfo function in the VideoResize.class.php file of the fileThumb Plugin.