Executive brief
ClipBucket is a popular video sharing and content management platform. The application contains a vulnerability in its photo upload feature that allows authenticated users to upload malicious PHP files disguised as images, leading to remote code execution on the server. An attacker with a valid account can take complete control of the web server and access sensitive data stored within the application.
Technical details
The vulnerability exists in the FileUpload::manageFile() function in fileupload.class.php, where MIME type validation is performed on uploaded files but the file extension is not properly updated after validation. An attacker can upload a PHP file with forged image magic bytes (MIME header) that passes MIME validation; the .php extension persists on disk and the file executes as PHP via PHP-FPM when accessed. This is a post-authentication remote code execution vulnerability requiring a valid user account. The vulnerability is fixed in version 5.5.3-#182 and later.
Affected products
- ClipBucket ClipBucket before 5.5.3-#182
Timeline
- 2026-09-18: disclosed
- 2026-08-28: patched: Fix released in version 5.5.3-#182