CVE-2025-64336
BaseFortify
Publication date: 2025-11-07
Last updated on: 2025-12-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oxygenz | clipbucket | From 5.3 (inc) to 5.5.2-147 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored Cross-site Scripting (XSS) issue in ClipBucket v5 versions 5.5.2-#146 and below. An authenticated regular user can upload a photo with a malicious Photo Title containing HTML or JavaScript code. Although the malicious code does not execute in the user-facing photo gallery or detail pages, it is rendered unsafely in the Admin → Manage Photos section, causing the JavaScript to execute in the administrator's browser. This can lead to unauthorized actions or data exposure in the admin interface. The issue is fixed in version 5.5.2-#147.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with regular user access to execute malicious JavaScript code in the administrator's browser when they view the Manage Photos section. This can lead to unauthorized actions performed with admin privileges, theft of sensitive information, session hijacking, or other malicious activities affecting the security and integrity of the platform.
What immediate steps should I take to mitigate this vulnerability?
Upgrade ClipBucket to version 5.5.2-#147 or later, where the vulnerability is fixed. Additionally, restrict access to the Admin → Manage Photos section to trusted administrators only and avoid opening suspicious photo titles containing HTML/JavaScript code until the upgrade is applied.