PT-2025-42787 · Unknown · Clipbucket

Published 2025-10-20 · Updated 2025-11-07 · CVE-2025-62429

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.2 #147

Description ClipBucket v5 is an open source video sharing platform susceptible to arbitrary PHP code execution. The type parameter within a POST request to the /upload/admin area/actions/update launch.php endpoint is incorporated into PHP tags and executed without adequate sanitization. This allows an attacker to execute arbitrary PHP code, potentially achieving Remote Code Execution (RCE).

Recommendations Update to ClipBucket version 5.5.2 #147 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-62429

GHSA-3X4G-X3GV-RJMQ

Affected Products

Clipbucket

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62429.json · Exploit
• 🔥 https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3x4g-x3gv-rjmq · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/e81bac602c871bb1ad971884003a3a496a2ab50b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62429 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62429 · Vendor Advisory
• https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23147 · Note
• https://twitter.com/VulmonFeeds/status/1980429556398924137 · Twitter Post
• https://twitter.com/CVEnew/status/1980314884249379197 · Twitter Post
• https://t.me/cveNotify/142127 · Telegram Post
• https://t.me/CVEtracker/35308 · Telegram Post