PT-2026-81894 · Unknown · Clipbucket-V5
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ClipBucket V5 (affected versions not specified)
Description
The web installer fails to properly validate or escape the
php cli filepath parameter before passing it to shell execution. This allows unauthenticated attackers to submit a crafted POST request to the installer with a malicious value in the php cli filepath variable to execute arbitrary commands as the web server user.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Clipbucket-V5