# CVE-2026-100372: ClipBucket path traversal in admin template editor

Source: https://junglewise.ai/threats/cve-2026-100372-clipbucket-v5-before-5-5-3-197-contains-a-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100372 · Severity: high · CVSS 7.2 · Published 2026-09-25

ClipBucket is an open-source video hosting platform. A path traversal vulnerability in the admin template editor allows authenticated administrators with the manage_template_access permission to overwrite PHP files outside the intended directory, leading to remote code execution with web server privileges.

Technologies: [MacWarrior ClipBucket](https://junglewise.ai/threats/technologies/clipbucket). Vendors: [MacWarrior](https://junglewise.ai/threats/vendors/macwarrior).

## Quick answers

**Is CVE-2026-100372 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100372 being exploited in the wild.

**How severe is CVE-2026-100372?** High severity, with a CVSS score of 7.2, published 25 September 2026.

**Which products and versions are affected?** MacWarrior ClipBucket v5 before 5.5.3-#197.

**Is there a fix for CVE-2026-100372?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100372 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100372?** Check whether you run MacWarrior ClipBucket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The template_editor.php admin interface fails to properly validate the folder parameter, allowing directory traversal sequences (e.g., ../) to be supplied. Authenticated administrators with manage_template_access permission can exploit this to write arbitrary PHP files anywhere on the filesystem, achieving remote code execution as the web server user. A fix is available in version 5.5.3-#197 and later.

## Affected products

- MacWarrior ClipBucket v5 before 5.5.3-#197

## Timeline

- 2026-09-25: disclosed

## References

- [https://github.com/MacWarrior/clipbucket-v5](https://github.com/MacWarrior/clipbucket-v5)
- [https://github.com/MacWarrior/clipbucket-v5/blob/61cce55ab26ef88fb782dfde47b44c17c56978cd/upload/admin_area/template_editor.php](https://github.com/MacWarrior/clipbucket-v5/blob/61cce55ab26ef88fb782dfde47b44c17c56978cd/upload/admin_area/template_editor.php)

## Related threats

- [ClipBucket reflected XSS in language settings](https://junglewise.ai/threats/cve-2026-110626-clipbucket-v5-through-5-5-3-206-contains-a-reflected-cross-site)
- [ClipBucket v5 reflected XSS in admin flagged_item.php](https://junglewise.ai/threats/cve-2026-110625-clipbucket-v5-through-5-5-3-206-contains-a-reflected-cross-site)
- [ClipBucket SQL injection in ads manager](https://junglewise.ai/threats/cve-2026-103766-clipbucket-v5-through-5-5-3-197-contains-an-sql-injection)
- [ClipBucket time-based blind SQL injection in language update](https://junglewise.ai/threats/cve-2026-102570-clipbucket-v5-through-5-5-3-197-contains-a-time-based-blind-sql)
- [ClipBucket time-based SQL injection in admin video edit](https://junglewise.ai/threats/cve-2026-102569-clipbucket-v5-through-5-5-3-197-contains-a-time-based-blind-sql)