CVE-2026-8753 Details

A command injection vulnerability has been identified in the KodBox application, specifically in versions through 1.64, within the FileThumb plugin. The issue arises in the 'parseVideoInfo' function of 'VideoResize.class.php', where the 'ffmpegBin' argument can be manipulated to execute arbitrary commands on the server. This vulnerability can be exploited remotely by authenticated users with plugin configuration rights.

To address this vulnerability, remove the direct concatenation of the 'ffmpegBin' value into shell commands. Instead, use safe process execution methods that separate command arguments to prevent injection. Additionally, validate and whitelist 'ffmpegBin' configurations to reject unsafe values before they can be exploited.