CVE-2026-77929
High
Description
ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function in fileupload.class.php fails to update the file extension after MIME validation, allowing an attacker-controlled .php extension to persist on disk and execute as PHP via PHP-FPM when the uploaded file is retrieved.
SeverityHigh
CVSS8.8
Exploit probability—
ProductMacwarrior Clipbucket-v5
PublishedSep 18, 2026
First seenSep 18, 2026
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- MacWarrior clipbucket-v55.5.3-#182 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MacWarrior clipbucket-v5 | v < 5.5.3-#182 | 5.5.3-#182 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.