ClipBucket v5
CVE-2026-42846
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states 'any authenticated user' can exploit, so PR:L not PR:N; network-reachable web feature with no user interaction yields full C/I/A as OS command execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.
AnalysisAI
Remote command injection in ClipBucket v5 prior to version 5.5.3 - #140 allows authenticated users to execute arbitrary OS commands by submitting a crafted URL through the Remote Play video import feature. The URL is concatenated unescaped into shell commands, so any metacharacter is interpreted by the shell, yielding code execution as the web server user. No public exploit identified at time of analysis, but the vendor-confirmed advisory and trivial exploitation pattern make this a high-priority issue for any internet-exposed deployment.
Technical ContextAI
ClipBucket v5 is an open-source PHP-based video sharing platform (CPE cpe:2.3:a:macwarrior:clipbucket-v5). The Remote Play feature accepts an external URL and passes it to shell utilities (commonly ffmpeg, wget, or yt-dlp wrappers) for fetching and transcoding. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the user-supplied URL is interpolated directly into a shell command string without escapeshellarg() or argument-array execution, so backticks, semicolons, $(), pipes, and newlines are evaluated by /bin/sh before the intended binary ever runs.
RemediationAI
Upgrade to ClipBucket v5 version 5.5.3 - #140 or later, which contains the vendor-released patch per GHSA-hvfx-hxmr-28c7 (https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-hvfx-hxmr-28c7). If immediate patching is not possible, disable the Remote Play / external URL import feature so authenticated users cannot submit remote URLs to the import handler - this removes the user-reachable sink at the cost of losing remote video ingestion. As an additional compensating control, restrict account registration to trusted users (disable self-registration or require admin approval) to shrink the pool of attackers, and place the application behind a WAF rule that rejects URL parameters to the import endpoint containing shell metacharacters (;, |, ` `, $(`, newline), accepting that a determined attacker may bypass regex-based filters. Run the PHP-FPM/Apache worker under a dedicated low-privilege account with no shell so successful exploitation cannot pivot to root.
More in Clipbucket V5
View allUnauthenticated blind SQL injection in ClipBucket v5 prior to version 5.5.3 - #129 allows remote attackers to exfiltrate
Authenticated SQL injection in ClipBucket v5 prior to release 5.5.3 - #132 allows any user with video-upload privileges
An authenticated time-based blind SQL injection vulnerability exists in the ClipBucket v5 open source video sharing plat
ClipBucket v5's subtitle management feature lacks ownership verification, enabling any authenticated user to upload, ren
SQL wildcard character injection in ClipBucket v5's subtitle editing endpoint allows authenticated users to overwrite al
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today