CVE-2026-8753 Overview
CVE-2026-8753 is a command injection vulnerability in kalcaddle Kodbox versions up to 1.64. The flaw resides in the parseVideoInfo function within /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php, part of the fileThumb plugin. Attackers manipulate the ffmpegBin argument to inject operating system commands. The issue is remotely exploitable and requires low-privilege authentication. The exploit has been disclosed publicly. The vendor was contacted before disclosure but did not respond. This vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Authenticated remote attackers can inject arbitrary operating system commands through the ffmpegBin parameter of the fileThumb plugin, potentially compromising the host application context.
Affected Products
- kalcaddle Kodbox versions up to and including 1.64
- fileThumb Plugin component
- VideoResize.class.php (parseVideoInfo function)
Discovery Timeline
- 2026-05-17 - CVE-2026-8753 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-8753
Vulnerability Analysis
The vulnerability exists in the fileThumb plugin shipped with kalcaddle Kodbox. The parseVideoInfo function in VideoResize.class.php is responsible for generating video thumbnails by invoking the ffmpeg binary. The function accepts an ffmpegBin argument that specifies the path to the ffmpeg executable. The application passes this argument into a shell-executed command without proper neutralization of shell metacharacters. Attackers supply crafted input that breaks out of the intended command context. The injected commands then execute under the privileges of the web server process running Kodbox.
Root Cause
The root cause is improper neutralization of special elements passed to a downstream command interpreter [CWE-74]. The ffmpegBin argument flows into a shell invocation without escaping or argument-array execution. User-controlled values reach the system shell directly.
Attack Vector
The attack is delivered remotely over the network and requires low-privilege authentication. An attacker triggers the vulnerable code path by submitting a request that causes the fileThumb plugin to invoke parseVideoInfo with attacker-controlled input for ffmpegBin. The EPSS score is 1.058% with a percentile of 77.863, indicating measurable exploitation likelihood relative to the broader CVE population. Detailed technical references are tracked under the VulDB Vulnerability Entry #364380 and the VulDB CTI record.
The vulnerability mechanism centers on the ffmpegBin argument being concatenated into a shell command string within parseVideoInfo. Shell metacharacters such as ;, |, &&, and backticks are not stripped or escaped, allowing chained command execution. See the VulDB Submission #810109 and the VulnPlus disclosure note for additional technical details.
Detection Methods for CVE-2026-8753
Indicators of Compromise
- Web server access logs showing requests to fileThumb plugin endpoints with shell metacharacters (;, |, &, `, $()) in parameters
- Unexpected child processes spawned by the PHP-FPM or web server process, particularly shells invoking sh, bash, wget, curl, or nc
- Outbound network connections originating from the Kodbox web server to unfamiliar hosts immediately after thumbnail generation requests
Detection Strategies
- Monitor process creation events where the parent process is the PHP runtime and the child process is a shell or network utility
- Inspect HTTP request parameters submitted to /plugins/fileThumb/ paths for shell metacharacters and encoded variants
- Correlate file upload activity with subsequent thumbnail generation requests that contain anomalous ffmpegBin values
Monitoring Recommendations
- Enable PHP disable_functions logging for exec, system, passthru, shell_exec, and popen calls originating from the fileThumb plugin
- Forward web server and PHP error logs to a central log platform for retention and correlation
- Track all child processes of the web server user and alert on shells, package managers, and network tools
How to Mitigate CVE-2026-8753
Immediate Actions Required
- Disable the fileThumb plugin in Kodbox until a vendor-supplied patch is available
- Restrict access to the Kodbox application to trusted authenticated users only, and enforce strong authentication on all accounts
- Place the Kodbox application behind a web application firewall configured to block shell metacharacters in plugin parameters
Patch Information
No vendor patch is currently available. The vendor was contacted before public disclosure and did not respond. Track the VulDB Vulnerability Entry #364380 for updates on remediation status.
Workarounds
- Remove or rename the VideoResize.class.php file under /workspace/source-code/plugins/fileThumb/lib/ to disable the vulnerable code path, accepting loss of video thumbnail functionality
- Run the PHP process under a dedicated low-privilege user account with no shell and a restrictive open_basedir configuration
- Apply egress filtering at the network boundary to block outbound connections initiated by the web server to non-approved destinations
- Audit existing Kodbox installations for unauthorized file changes, scheduled tasks, or web shells before applying any mitigation
# Configuration example - disable shell execution functions in php.ini
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec
open_basedir = /var/www/kodbox/:/tmp/
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
