CVE-2026-26833 — thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenated into a shell command string passed to c — CVE Database · The Intelligence Room