The vulnerability resides in the checkBin function of the fileThumb endpoint in kalcaddle kodbox 1.64, enabling an attacker to inject operating‑system commands. The weakness is classified as OS Command Injection (CWE‑77, CWE‑78). Successful exploitation allows the attacker to execute arbitrary commands on the target server, potentially compromising confidentiality, integrity, and availability of the system.

Vendor kalcaddle’s kodbox platform, specifically version 1.64, contains the fileThumb plugin with the vulnerable checkBin endpoint.

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The design of the flaw permits remote exploitation without authentication, and a publicly available exploit has already been released. This combination of remote, unauthenticated access, public exploit, and the potential for arbitrary code execution elevates the practical risk to a significant level for any unpatched system.