PT-2025-42631 · Unknown · Clipbucket

Published 2025-10-17 · Updated 2025-10-17 · CVE-2025-62424

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.2 - #147

Description ClipBucket is a web-based video-sharing platform. The /admin area/template editor.php API endpoint has insufficient validation of the file-loading path. This allows administrators to read and write arbitrary files outside the intended template directory by using path traversal sequences in the folder parameter. An attacker with administrator privileges can read sensitive files, such as /etc/passwd, and modify writable files on the system, potentially leading to sensitive information disclosure and system compromise.

Recommendations Update to ClipBucket version 5.5.2 - #147 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-62424

GHSA-3V2P-RFWX-52QJ

Affected Products

Clipbucket

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62424.json · Exploit
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3v2p-rfwx-52qj · Vendor Advisory
• https://github.com/MacWarrior/clipbucket-v5/commit/c06d0f2e69c9acb008cebbd34fd5f29da3191a28 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62424 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62424 · Vendor Advisory
• https://twitter.com/CVEnew/status/1979289024931008747 · Twitter Post
• https://t.me/cveNotify/139233 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1979258843738562575 · Twitter Post
• https://t.me/CVEtracker/35208 · Telegram Post