CVE-2026-100372 in ClipBucket
Summary
by MITRE • 09/25/2026
ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in ClipBucket versions prior to 5.5.3-#197 represents a critical security flaw rooted in improper input validation within the administrative template editor interface. This specific weakness is classified under CWE-22, which denotes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The core technical failure occurs when the application processes user-supplied data for the folder parameter without adequately sanitizing or validating it against expected directory structures. By injecting standard directory traversal sequences such as dot-dot-slash (../) into this input field, an attacker can manipulate the file system operations to navigate outside of the intended layout directory boundaries. This lack of strict path canonicalization allows the administrative function to write files in arbitrary locations on the server's filesystem rather than restricting writes strictly within the designated template folder.
The operational impact of this vulnerability is severe due to its potential for remote code execution. An attacker who possesses valid credentials with manage_template_access permissions can exploit this flaw to overwrite existing PHP files or create new malicious script files in executable directories. Since ClipBucket typically runs under the context of a web server user, successfully writing and subsequently accessing these manipulated files allows the attacker to execute arbitrary commands on the host system with the same privileges as the web service process. This effectively grants full control over the underlying operating environment, enabling data exfiltration, defacement, or further lateral movement within the network infrastructure. The requirement for authentication does not mitigate the risk significantly in environments where administrative credentials may be compromised through phishing, credential stuffing, or other means of account takeover.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Persistence and Execution via Web Shell deployment. Specifically, it facilitates the T1505 technique known as Server Software Component: Web Shell, where attackers install malicious scripts that provide persistent access to compromised systems. The ability to write arbitrary files in executable directories is a primary vector for establishing such backdoors. Security analysts should note that this type of vulnerability often indicates deeper issues with input validation frameworks and file handling libraries within the application codebase, suggesting that similar flaws may exist in other administrative functions that handle file paths or content uploads.
Mitigation strategies must prioritize immediate patching to version 5.5.3-#197 or later, which addresses these path traversal checks by implementing strict allow-lists for directory access and enforcing canonicalization of all file paths before processing. In the interim, if upgrading is not immediately feasible, administrators should restrict web server permissions to prevent write operations in critical executable directories outside of designated template folders. Additionally, implementing a Web Application Firewall with rules specifically targeting path traversal sequences can provide an additional layer of defense by blocking malicious requests at the network perimeter. Regular audits of administrative access controls and monitoring for unusual file system modifications are also recommended to detect potential exploitation attempts early.