This vulnerability exists in the parseVideoInfo function of the fileThumb plugin in kalcaddle Kodbox up to version 1.64. The issue arises from improper handling of the ffmpegBin argument, which can be manipulated to perform command injection. This allows an attacker to execute arbitrary commands remotely. The vendor was notified but has not issued any patch or remediation guidance. No known exploits in the wild have been reported to date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system remotely, potentially leading to unauthorized system access or control. Given the medium CVSS score and the nature of command injection, the impact is significant but may require some level of privileges or conditions to exploit effectively.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider disabling or restricting access to the vulnerable fileThumb plugin or the affected function if possible. Monitoring for unusual activity related to ffmpegBin usage is advisable until a patch is released.