Read the docs
TI-2026-54246 Aliases CVE-2026-77929GHSA-g885-94pf-hc9v

ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

Priority MEDIUM 41CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function in fileupload.class.php fails to update the file extension after MIME validation, allowing an attacker-controlled .php extension to persist on disk and execute as PHP via PHP-FPM when the uploaded file is retrieved.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00941 61st percentileScored 2026-11-07
Fix Fixed clipbucket-v5 (MacWarrior): 5.5.3-#182

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MacWarriorclipbucket-v5before 5.5.3-#1825.5.3-#182Patch availableCNA
  • clipbucket-v5 VendorMacWarrior Affected before 5.5.3-#182 Fixed in 5.5.3-#182 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:*——MacWarrior
  • cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:* Versions — — ·MacWarrior

Remediation

  • Fix · CNA clipbucket-v5 (MacWarrior) Fixed in 5.5.3-#182

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MacWarrior clipbucket-v5 5.5.3-#182

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-54245 ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion EndpointPriority LOW 32
    • TI-2026-54244 ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion EndpointPriority LOW 32
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77929
  2. 2026-10-03 Alias added: GHSA-g885-94pf-hc9v

References

Patch 1

Other 1

  • TI-2026-32908 ClipBucket: Blind SQL Injection in progress_video.php CVSS 3.1CRITICAL 9.8
  • TI-2026-31055 ClipBucket: Remote Play URL Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-17576 ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments CVSS 3.1CRITICAL 9.8
  • TI-2025-41207 ClipBucket 5.5.2 is affected by an improper access control issue where the product is… CVSS 3.1CRITICAL 9.8
  • TI-2025-15584 ClipBucket V5 Playlist Cover File Upload to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2024-36252 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below CVSS 3.1CRITICAL 9.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences