CVE-2025-21624
Critical
Description
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239.
SeverityCritical
CVSS9.8
Exploit probability—
ProductOxygenz Clipbucket
PublishedJan 7, 2025
First seenJan 7, 2025
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- oxygenz clipbucket5.5.1-239 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oxygenz clipbucket | 5.3 ≤ v < 5.5.1-239 | 5.5.1-239 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.