Executive brief
ClipBucket is an open-source video hosting platform. An unauthenticated attacker can exploit the web installer to execute arbitrary commands on the server by submitting a malicious request with an unsanitized php_cli_filepath parameter, potentially taking full control of the hosting environment.
Technical details
The vulnerability is a command injection flaw in ClipBucket V5's web installer. The php_cli_filepath parameter is not properly validated or escaped before being passed to shell execution functions. An unauthenticated attacker can craft a POST request to the installer endpoint with a malicious php_cli_filepath value containing shell metacharacters to execute arbitrary system commands with the privileges of the web server user. The attack requires network access to an uninstalled or reinstalled ClipBucket instance with the installer still enabled, but does not require prior authentication.
Affected products
- MacWarrior ClipBucket V5 5.5.3 and possibly earlier
Timeline
- 2026-08-25: disclosed