CVE-2025-21624: fallo crítico en MacWarrior clipbucket-v5
ClipBucket V5 Playlist Cover File Upload to Remote Code Execution
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 1.2%
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
MacWarrior · clipbucket-v5CVEs relacionadas — MacWarrior clipbucket-v5
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-21875CRITICALClipBucket v5 Vulnerable to Blind SQL Injection through Channel CommentsEPSS 1.8%CVE-2026-80138CRITICALClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath ParameterEPSS 1.2%CVE-2025-21623HIGHClipBucket V5 Unauthenticated Template Directory Update to Denial-of-ServiceEPSS 1.2%CVE-2026-100372HIGHClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.phpEPSS 1.1%CVE-2025-21622HIGHClipBucket V5 Avatar URL Path Traversal to Arbitrary File DeleteEPSS 1.0%CVE-2026-77929HIGHClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload EndpointEPSS 0.9%