Executive brief
Kalcaddle Kodbox, a web-based document management and collaboration platform, contains a security flaw in its video thumbnail processing component. An attacker can exploit this to run unauthorized commands on the server hosting the application. This could lead to a full system compromise, data theft, or disruption of business operations. The vulnerability is currently public, and the vendor has not yet released a fix.
Technical details
A command injection vulnerability exists in Kalcaddle Kodbox versions up to 1.64 within the fileThumb plugin. The flaw is located in the parseVideoInfo function of the /workspace/source-code/plugins/fileThumb/lib/VideoResize.class.php file. The application fails to properly sanitize the 'ffmpegBin' argument before passing it to a system shell, allowing an authenticated remote attacker to execute arbitrary commands. While the attack requires low privileges (PR:L), the exploit has been publicly disclosed. As of the advisory date, the vendor has not responded to the disclosure, and no patch is currently available.
Affected products
- kalcaddle Kodbox up to 1.64
Timeline
- 2026-05-17: advisory: Vulnerability disclosed via VulDB and NVD
- 2026-05-17: disclosed: Public exploit code has been disclosed