Handler on Duty: Rob VandenBrink
Threat Level: green
| Published | 2026-08-25 23:17:59 |
|---|---|
| Last Modified | 2026-08-25 23:17:59 |
| AKA | CVE-2026-80138 |
| Summary | ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user. |
| Access Vector | Local | Adjacent | Network |
|---|---|---|---|
| Access Complexity | Low | Medium | High |
| Authentication | None | Single | Multiple |
| Confidentiality | None | Partial | Complete |
| Integrity | None | Partial | Complete |
| Availability | None | Partial | Complete |
