A vulnerability was found in MacWarrior clipbucket-v5 up to 5.5.1-238 and classified as very critical. Affected by this issue is an unknown function of the component Image File Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-21624 since 12/29/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 01/07/2025). This vulnerability is assigned to T1608.002 by the MITRE ATT&CK project.

Upgrading to version 5.5.1-239 eliminates this vulnerability.

Productinfo

Vendor

• MacWarrior

Name

• clipbucket-v5

Version

• 5.5.1-238

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion