CVE-2026-80138
CriticalCVSS 9.8Summary
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.
Risk Assessment
Risk of server compromise and arbitrary code execution without authentication, potentially leading to full system takeover.
Recommendation
Update ClipBucket to the latest patched version. If possible, restrict access to the installer to trusted IP addresses only.
Original NVD description (English source)
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.