Is there a public PoC exploit available for CVE-2026-8753?

Yes, a public proof-of-concept exploit is available for CVE-2026-8753. Prioritise patching immediately. EPSS: 0.8%.

Kodbox CVE-2026-8753

Q: What is the CVSS score of CVE-2026-8753?

CVE-2026-8753 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-30698 LOW

Command Injection (CWE-77)

2026-05-17 VulDB

GHSA-83hf-596r-v39j

Command Injection PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 17, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

May 17, 2026 - 13:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 17, 2026 - 13:00 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote command injection in Kodbox fileThumb plugin (versions up to 1.64) allows authenticated attackers to execute arbitrary system commands by manipulating the ffmpegBin parameter in video processing functions. Publicly available exploit code increases immediate risk. EPSS data not available, but CVSS temporal metrics indicate confirmed proof-of-concept exploitation (E:P). Vendor has not responded to disclosure, leaving patch status uncertain.

Technical ContextAI

Kodbox is a PHP-based private cloud storage and file management system. The vulnerability resides in the fileThumb plugin's VideoResize.class.php component, specifically the parseVideoInfo function responsible for processing video thumbnails. The flaw is a classic command injection (CWE-77) where user-controlled input to the ffmpegBin argument is not properly sanitized before being passed to system command execution functions. FFmpeg is a multimedia framework commonly invoked via shell commands for video transcoding tasks. When application code constructs shell commands by concatenating user input without validation or escaping, attackers can inject additional commands using shell metacharacters (semicolons, pipes, backticks). The affected CPE (cpe:2.3:a:kalcaddle:kodbox) identifies this as a kalcaddle vendor product, with versions through 1.64 confirmed vulnerable.

RemediationAI

No vendor-released patch identified at time of analysis - kalcaddle has not responded to vulnerability disclosure per VulDB submission 810109. Organizations must implement compensating controls immediately: (1) Disable the fileThumb plugin entirely if video thumbnail generation is not business-critical, eliminating the attack surface but removing preview functionality. (2) Restrict access to video upload and processing features to only highly trusted administrator accounts through role-based access controls, reducing the pool of potential authenticated attackers but not preventing abuse by compromised credentials. (3) Implement Web Application Firewall rules to block requests containing shell metacharacters (semicolons, pipes, backticks, dollar signs) in parameters processed by /plugins/fileThumb/ endpoints, though sophisticated encoding bypasses may evade pattern matching. (4) Deploy application-level input validation to whitelist only expected FFmpeg binary paths (e.g., /usr/bin/ffmpeg) and reject any path containing traversal sequences or special characters, though this requires code modification. (5) Run the Kodbox application with minimal filesystem permissions and consider containerization to limit command execution impact. Monitor vendor channels at https://kodcloud.com for future patches and consider migrating to maintained alternatives if vendor remains unresponsive. Reference the technical analysis at https://vulnplus-note.wetolink.com/share/R0hHqwMywhsm for exploit specifics when designing mitigations.