Cyber Posture

CVE-2025-21624

CriticalPublic PoC

Published: 07 January 2025

Published
07 January 2025
Modified
05 September 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.2704 96.4th percentile
Risk Priority 36 60% EPSS · 20% KEV · 20% CVSS

Description

ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239.

Security Summary

CVE-2025-21624 is a critical file upload vulnerability (CVSS 9.8; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; CWE-434) in ClipBucket V5, an open-source PHP-based video hosting platform. In versions prior to 5.5.1-239, the Manage Playlist functionality fails to properly validate uploaded playlist cover images, allowing attackers to upload PHP script files instead of legitimate images. This enables storage and execution of malicious files, such as webshells, on the server. The issue affects both the admin area and low-level user areas.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By uploading a malicious PHP file via the playlist cover image upload feature, attackers achieve remote code execution on the server, potentially leading to full compromise including data theft, modification, or disruption, as indicated by the high impact scores across confidentiality, integrity, and availability.

ClipBucket addresses this vulnerability in version 5.5.1-239. Security practitioners should upgrade to this patched release immediately. Additional details, including the fix implementation, are available in the GitHub security advisory at https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-98vm-2xqm-xrcc and the corresponding commit at https://github.com/MacWarrior/clipbucket-v5/commit/893bfb0f1236c4a59b5e2843ab8d27a1e491b12b.

Details

CWE(s)
CWE-434

Affected Products

oxygenz
clipbucket
5.3 — 5.5.1-239

References