ClipBucket v5 CVE-2026-100372

Requires an authenticated ClipBucket v5 administrator account holding the manage_template_access permission and access to the admin_area template editor (template_editor.php). The attacker supplies directory-traversal sequences in the folder/file parameters to escape the styles/layout directory; the pre-patch code (regex /.*\.(.*)$/ accepting any extension plus an insufficient realpath prefix check) permits writing executable PHP outside the intended directory. Limiting factors: the admin privilege and manage_template_access gate (PR:H) mean this is not exploitable by unauthenticated or low-privileged users; it is confined to versions before 5.5.3-#197.

This is a genuine but access-gated risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) correctly reflects network-reachable, low-complexity exploitation that nonetheless requires high privileges - specifically an authenticated administrator holding the manage_template_access permission. The VC:H/VI:H/VA:H rating is justified because the outcome is arbitrary PHP file overwrite yielding remote code execution as the web-server user. A public POC exists (hackmd writeup by @leediay) and the vendor patch is confirmed (commit f31de49b, release 5.5.3-#197), so exploitation is documented and reproducible - but this is 'publicly available exploit code exists,' NOT active exploitation: there is no CISA KEV listing and no EPSS score supplied. No SSVC decision data was provided. The high CVSS (8.6) is somewhat tempered by the PR:H requirement - an attacker must already be a privileged admin, which limits this to insider abuse, compromised-admin-credential, or privilege-chaining scenarios rather than mass unauthenticated exploitation. Net: real and weaponizable against exposed ClipBucket v5 admin panels, but the admin gate and niche footprint keep realistic exploitation targeted rather than widespread.

An attacker who has obtained ClipBucket v5 admin credentials (or an insider) with manage_template_access opens the template editor and submits a file/folder value containing '../' sequences pointing outside the styles/layout directory to a live PHP file, overwriting it with attacker-controlled PHP. On the next request to that path the injected code executes as the web-server user, granting remote code execution. A public POC (hackmd) documents the exact traversal, lowering the skill barrier.