A vulnerability exists in the Media File Preview Plugin of kalcaddle kodbox through the VideoResize class. A crafted argument named localFile can bypass input validation and trigger arbitrary operating‑system commands. This permits an attacker to execute commands on a server hosting the plugin, compromising confidentiality, integrity, and availability of the affected system. The flaw is classified as a command‑injection weakness, identified by CWE‑77 and CWE‑78.

The issue affects kalcaddle kodbox up to version 1.64.05 across all deployments that use the Media File Preview Plugin. No specific edition or environment details were provided, but any installation that includes plugins/fileThumb/lib/VideoResize.class.php is potentially vulnerable.

The CVSS base score of 5.3 places this vulnerability in the medium severity range. The EPSS score of less than 1% suggests a very low probability of exploitation in the general population. The vulnerability has been publicly disclosed and is not listed in CISA’s KEV catalog, meaning there are no documented mitigations. The attack can be carried out remotely by supplying a crafted localFile parameter to invoke arbitrary operating‑system commands. Successful exploitation would allow an attacker to execute commands on the server hosting the plugin, potentially compromising confidentiality, integrity, and availability of the affected system.