TI-2025-15582 Aliases CVE-2025-21622

ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete

HIGH 78CWE-22Published 2025-01-07 · Updated 2025-01-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url as a filepath within the avatars subdirectory. If the URL path exists within the avatars directory, ClipBucket will delete it. There is no check for path traversal sequences in the provided user input (stored in the DB as avatar_url) therefore the final $file variable could be tainted with path traversal sequences. This leads to file deletion outside of the intended scope of the avatars folder. This vulnerability is fixed in 5.5.1 - 237.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00998 62nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MacWarrior	clipbucket-v5	< 5.5.1 - 237	—	No fix listed	CNA

clipbucket-v5 VendorMacWarrior Affected < 5.5.1 - 237 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:oxygenz:clipbucket::::::::	5.3 to before 5.5.1-237	Vulnerable	MacWarrior

cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:* Versions 5.3 to before 5.5.1-237 Vulnerable ·MacWarrior

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-21622

References

Exploit 1

https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-5qpx-23rw-36gg

Patch 1

https://github.com/MacWarrior/clipbucket-v5/commit/22329c4675e82c7c95e74024ba247f837ac9e00b

TI-2026-17576 ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments CVSS 3.1CRITICAL 9.8
TI-2025-41207 ClipBucket 5.5.2 is affected by an improper access control issue where the product is… CVSS 3.1CRITICAL 9.8
TI-2025-15584 ClipBucket V5 Playlist Cover File Upload to Remote Code Execution CVSS 3.1CRITICAL 9.8
TI-2024-36252 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below CVSS 3.1CRITICAL 9.8
TI-2024-36251 Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199 CVSS 3.1CRITICAL 9.8
TI-2026-20797 ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition CVSS 4.0CRITICAL 9.3

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences