CVE-2026-80138

Name of the Vulnerable Software and Affected Versions ClipBucket V5 (affected versions not specified)

Description The web installer fails to properly validate or escape the php cli filepath parameter before passing it to shell execution. This allows unauthenticated attackers to submit a crafted POST request to the installer with a malicious value in the php cli filepath variable to execute arbitrary commands as the web server user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.