PT-2025-4306 · Unknown · Clipbucket

Kawing-Ho · Published 2025-01-07 · Updated 2025-09-05 · CVE-2025-21622

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ClipBucket V5 versions prior to 5.5.1 - 237

Description The issue arises during the user avatar upload workflow, where a user can upload and change their avatar at any time. During deletion, ClipBucket checks if the avatar url is a filepath within the avatars subdirectory. If the URL path exists within the avatars directory, ClipBucket will delete it. However, there is no check for path traversal sequences in the provided user input, stored in the database as avatar url. This allows the final $file variable to be tainted with path traversal sequences, leading to file deletion outside of the intended scope of the avatars folder.

Recommendations For ClipBucket V5 versions prior to 5.5.1 - 237, update to version 5.5.1 - 237 to resolve the issue. As a temporary workaround, consider restricting access to the avatar upload functionality to minimize the risk of exploitation. Additionally, avoid using user-provided input for file deletion operations until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-21622

GHSA-5QPX-23RW-36GG

Affected Products

Clipbucket

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21622.json · Exploit
• 🔥 https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-5qpx-23rw-36gg · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/22329c4675e82c7c95e74024ba247f837ac9e00b · Patch
• https://osv.dev/vulnerability/CVE-2025-21622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21622 · Security Note
• https://t.me/cveNotify/134401 · Telegram Post
• https://twitter.com/CVEnew/status/1876662295859753112 · Twitter Post