Command Injection in Kalcaddle Kodbox by Vulnerable FileThumb Plugin

CVE-2026-4591

What is CVE-2026-4591?

A vulnerability has been discovered in the Kalcaddle Kodbox 1.64 due to a flaw in the 'checkBin' function located in the file '/workspace/source-code/plugins/fileThumb/app.php'. This weakness permits an attacker to perform OS command injection remotely through the exploitation of the fileThumb endpoint. Unfortunately, despite prior notification to the vendor regarding this issue, no response was received. The vulnerability is of significant concern as public exploits have been made accessible, increasing the risk of unauthorized actions taking place on affected systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References