ClipBucket v5 CVE-2025-62429

Requires an authenticated session with administrator privileges to the ClipBucket v5 admin backend (consistent with PR:H), specifically access to the update/SQL-update workflow that reaches /upload/admin_area/actions/update_launch.php. The attacker supplies a malicious 'type' value in a POST request, which is embedded into PHP tags and executed server-side without sanitization (CWE-94). Affected: ClipBucket v5 prior to 5.5.2 #147. Limiting factors that reduce real-world exposure: the endpoint is in the admin area so prior admin authentication is mandatory, there is no unauthenticated path in the provided data, and the fix in 5.5.2 #147 remediates it - so patched instances or network-restricted admin panels are not exploitable.

CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, meaning network-reachable, low-complexity, no user interaction, but requiring HIGH privileges (PR:H). This single factor is the dominant risk moderator: the vulnerable endpoint /upload/admin_area/actions/update_launch.php lives in the authenticated administrator area, so an attacker must already hold admin-level access to the ClipBucket backend before the PHP code-injection becomes reachable. A publicly available exploit/advisory exists (GitHub GHSA-3x4g-x3gv-rjmq), which raises weaponization potential, but POC availability is NOT the same as active exploitation. The CVE is NOT listed in CISA KEV and no EPSS probability was provided in the input, so there is no signal of widespread or confirmed real-world exploitation - absence of these should be read as 'unknown', not 'safe'. No SSVC decision data was supplied. Net assessment: a genuine RCE but gated behind administrative authentication, so it is best characterized as a post-authentication privilege-to-code-execution escalation rather than a drive-by unauthenticated RCE. Priority is moderate for internet-exposed admin panels (especially where admin credentials are weak/shared), lower where the admin interface is network-restricted. One caveat to verify: the supplied vendor commit diff addresses a 'stuck update notice' and the force_no_stuck_icon flag rather than visibly sanitizing the 'type' parameter, so the exact fix mechanism could not be independently confirmed from the diff alone.

An attacker who has obtained ClipBucket administrator access (via stolen/weak credentials or a chained flaw) sends a crafted POST request to /upload/admin_area/actions/update_launch.php with a malicious 'type' value; because the value is embedded unsanitized inside PHP tags and executed, arbitrary PHP runs on the server, yielding full RCE in the web application context. Public exploit/advisory material exists (GHSA-3x4g-x3gv-rjmq), lowering the effort to reproduce. The network vector and low complexity (AV:N/AC:L) make the request trivial once admin authentication is held.