CVE-2026-2560

🗓️ 16 Feb 2026 14:02:06Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

CVE-2026-2560: Remote OS command injection in kalcaddle kodbox up to 1.64.05 via VideoResize run.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-2560	16 Feb 202614:02	–	attackerkb
CNNVD	kodbox 操作系统命令注入漏洞	16 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-2560 kalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injection	16 Feb 202614:02	–	cvelist
EUVD	EUVD-2026-6080	16 Feb 202615:32	–	euvd
NVD	CVE-2026-2560	16 Feb 202614:16	–	nvd
Positive Technologies	PT-2026-8349	16 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2560	17 Feb 202619:24	–	redhatcve
Vulnrichment	CVE-2026-2560 kalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injection	16 Feb 202614:02	–	vulnrichment

Vulners

Node

kodcloud kodboxMatch1.64.05

[
  {
    "vendor": "kalcaddle",
    "product": "kodbox",
    "versions": [
      {
        "version": "1.64.05",
        "status": "affected"
      }
    ],
    "modules": [
      "Media File Preview Plugin"
    ]
  }
]

Source	Link
gist	www.gist.github.com/DReazer/d7380aca4ade9fd73b688633901367ed
gist	www.gist.github.com/DReazer/d7380aca4ade9fd73b688633901367ed
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
localFile	path	plugins/fileThumb/lib/VideoResize.class.php	OS command injection via manipulation of the localFile argument in VideoResize.class.php (Media File Preview Plugin).	CWE-78, CWE-77

29 Apr 2026 01:00Current

5.4Medium risk

Vulners AI Score5.4

CVSS 45.3

CVSS 3.16.3

CVSS 26.5

CVSS 36.3

EPSS0.00371

SSVC