CVE-2026-8753— kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-8753
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-8753
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8753
请登录查看更多情报信息。
Advisory · 1
- https://vuldb.com/submit/810109third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-8753
IV. Related Vulnerabilities
Same product: Kodbox
- CVE-2026-5618
kalcaddle kodbox shareMake/shareCheck server-side request fo - CVE-2026-4831
kalcaddle kodbox Password-protected Share auth.class.php can - CVE-2026-4830
kalcaddle kodbox Public Share userShare.class.php add privil - CVE-2026-4592
kalcaddle kodbox Password Login index.class.php tfaVerify im - CVE-2026-4591
kalcaddle kodbox fileThumb Endpoint app.php checkBin os comm
Same vendor: kalcaddle
- CVE-2026-5618
kalcaddle kodbox shareMake/shareCheck server-side request fo - CVE-2026-4831
kalcaddle kodbox Password-protected Share auth.class.php can - CVE-2026-4830
kalcaddle kodbox Public Share userShare.class.php add privil - CVE-2026-4592
kalcaddle kodbox Password Login index.class.php tfaVerify im - CVE-2026-4591
kalcaddle kodbox fileThumb Endpoint app.php checkBin os comm
Same weakness: CWE-77
- CVE-2026-8777
Edimax BR-6428NS POST Request formStaDrvSetup command inject - CVE-2026-8774
Edimax BR-6228NC POST Request mp command injection - CVE-2026-46508
Turborepo: VSCode Extension command injection - CVE-2026-41953
BIG-IP Privilege Escalation vulnerability - CVE-2026-40698
iControl REST and TMSH vulnerability
V. Comments for CVE-2026-8753
No comments yet