PT-2025-31538 · Clipbucket · Clipbucket

Published 2025-07-31 · Updated 2025-09-23 · CVE-2013-10040

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 2.7

Description The software contains a critical issue in the ofc upload image.php script, located at the /admin area/charts/ofc-library/ endpoint. This allows unauthenticated users to upload arbitrary files, including executable PHP scripts. After uploading, an attacker can access the file through a predictable path and trigger remote code execution. The ofc upload image.php script is the component affected.

Recommendations Update to version 2.7 or later. As a temporary workaround, restrict access to the ofc upload image.php script.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2013-10040

Affected Products

Clipbucket

References · 7

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/clipbucket_upload_exec.rb · Exploit
• 🔥 https://packetstorm.news/files/id/123480 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-10040 · Security Note
• https://github.com/arslancb/clipbucket · Note
• https://vulncheck.com/advisories/clipbucket-arbitrary-file-upload-rce · Note
• https://clipbucket.com · Note
• https://t.me/cveNotify/136228 · Telegram Post