# CVE-2025-62424: ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - #146 and earlier, the…

Source: https://junglewise.ai/threats/cve-2025-62424-clipbucket-is-a-web-based-video-sharing-platform-in-clipbucket  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-17  
License: CC BY 4.0 with a link back

CVE-2025-62424 · Severity: medium · CVSS 6.7 · Published 2025-10-17

ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - #146 and earlier, the /admin_area/template_editor.php endpoint is vulnerable to path traversal. The validation of the file-loading path is inadequate, allowing authenticated administrators to read and write arbitrary files outside the intended template directory by inserting path traversal sequences into the folder parameter. An attacker with administrator privileges can exploit this vulnerability to read sensitive files such as /etc/passwd and modify writable files on the system, potentially leading to sensitive information disclosure and compromise of the application or server. This issue is fixed in version 5.5.2 - #147.

Technologies: [Oxygenz Clipbucket](https://junglewise.ai/threats/technologies/oxygenz-clipbucket). Vendors: [Oxygenz](https://junglewise.ai/threats/vendors/oxygenz).

## Quick answers

**Is CVE-2025-62424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62424 being exploited in the wild.

**How severe is CVE-2025-62424?** Medium severity, with a CVSS score of 6.7, published 17 October 2025.

**Which products and versions are affected?** Oxygenz Clipbucket. The advisory does not name versions.

**Is there a fix for CVE-2025-62424?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-62424?** Check whether you run Oxygenz Clipbucket. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Oxygenz Clipbucket

## Related threats

- [ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass…](https://junglewise.ai/threats/cve-2025-65113-clipbucket-v5-is-an-open-source-video-sharing-platform-prior-to)
- [ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php…](https://junglewise.ai/threats/cve-2025-62709-clipbucket-v5-is-an-open-source-video-sharing-platform-in)
- [ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular…](https://junglewise.ai/threats/cve-2025-64338-clipbucket-v5-is-an-open-source-video-sharing-platform-in)
- [ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated…](https://junglewise.ai/threats/cve-2025-64114-clipbucket-v5-is-an-open-source-video-sharing-platform-versions-5)
- [ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site…](https://junglewise.ai/threats/cve-2025-62715-clipbucket-v5-is-an-open-source-video-sharing-platform-versions-5)