CVE-2026-80138 in ClipBucket
Summary
by MITRE • 08/26/2026
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in ClipBucket V5 represents a critical remote code execution flaw rooted in improper input validation within its automated installation script. The core technical deficiency lies in the handling of the php_cli_filepath parameter, which is intended to specify the path to the PHP Command Line Interface executable for system checks during setup. Instead of strictly validating this input against an allowlist or sanitizing it through robust escaping mechanisms, the application directly concatenates user-supplied data into a shell command string that is subsequently executed by the operating system's interpreter. This architectural oversight creates a classic command injection vector where unauthenticated actors can manipulate the execution context of the web server process.
From an operational perspective, this flaw allows any external actor with network access to the installation endpoint to achieve arbitrary code execution without requiring valid credentials or prior authentication. By crafting a specific POST request containing malicious payloads within the php_cli_filepath field, attackers can inject additional shell commands that are executed with the privileges of the web server user, typically www-data on Linux systems or IUSR/IIS_IUSRS on Windows environments. This level of access is particularly dangerous as it often grants read and write permissions to application files, database configurations, and potentially sensitive system directories, facilitating complete compromise of the underlying infrastructure hosting the ClipBucket instance.
The security implications align closely with Common Weakness Enumeration (CWE) identifiers such as CWE-78 Improper Neutralization of Special Elements used in an OS Command or CWE-94 Improper Control of Generation of Code. In terms of offensive cybersecurity frameworks, this vulnerability maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically the sub-technique for Unix Shell commands. The lack of authentication requirement places it among high-severity issues as defined by CVSS scoring guidelines due to its low attack complexity and broad impact on confidentiality, integrity, and availability.
Mitigation strategies must prioritize immediate remediation through software updates if a patched version is available from the vendor. In cases where an update is not immediately accessible, administrators should restrict access to the installation directory using web server configuration directives such as Apache's Require all denied or Nginx's deny all rules for paths containing install.php or similar setup scripts once deployment is complete. Additionally, implementing strict input validation on any remaining user-facing parameters and ensuring that the web server process runs with minimal necessary privileges can significantly reduce the blast radius of potential exploitation attempts until permanent fixes are applied.