Description
A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib/VideoResize.class.php of the component Media File Preview Plugin. Such manipulation of the argument localFile leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-02-16
Score: 5.3 Medium
EPSS: 1.4% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in the Media File Preview Plugin of kalcaddle kodbox in the VideoResize class. The localFile argument can be manipulated to bypass input validation and trigger arbitrary operating‑system commands through the run function. This allows an attacker to execute commands on the server hosting the plugin. The flaw is classified by CWE‑77 and CWE‑78.

Affected Systems

This vulnerability affects kalcaddle kodbox versions up to 1.64.05 that include the Media File Preview Plugin. Any installation containing plugins/fileThumb/lib/VideoResize.class.php is potentially vulnerable.

Risk and Exploitability

The CVSS base score of 5.3 indicates a medium severity level. The EPSS score of 1% suggests the likelihood of exploitation is low in the general population. The vulnerability is not listed in CISA’s KEV catalog. The exploit is remote, requiring only a crafted localFile parameter to invoke operating‑system commands.

Generated by OpenCVE AI on June 18, 2026 at 10:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a kalcaddle kodbox release newer than 1.64.05 where the insecure input handling in VideoResize.class.php has been corrected.
  • If an upgrade is not immediately possible, patch VideoResize.class.php to properly validate or sanitize the localFile argument before it is used to build a system command.
  • Disable or remove the Media File Preview Plugin (or the VideoResize component) if the preview feature is not required, thereby eliminating the vulnerable code.
  • Set restrictive permissions on the web server and PHP runtime so that the plugin code runs with the least privileges necessary, and employ host‑based controls such as chroot, AppArmor, or SELinux to limit the impact of any potential exploitation.

Generated by OpenCVE AI on June 18, 2026 at 10:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 17 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 17 Feb 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Kalcaddle
Kalcaddle kodbox
Vendors & Products Kalcaddle
Kalcaddle kodbox

Mon, 16 Feb 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib/VideoResize.class.php of the component Media File Preview Plugin. Such manipulation of the argument localFile leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title kalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Kalcaddle Kodbox
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T10:11:14.696Z

Reserved: 2026-02-15T19:07:03.869Z

Link: CVE-2026-2560

cve-icon Vulnrichment

Updated: 2026-02-17T14:58:37.070Z

cve-icon NVD

Status : Deferred

Published: 2026-02-16T14:16:18.840

Modified: 2026-06-17T10:31:19.123

Link: CVE-2026-2560

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T11:00:04Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')