CVE-2026-80138

Received Received - Intake

ClipBucket V5 Command Injection via Web Installer

Publication date: 2026-08-25

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-03

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-80138

EUVD

EUVD-2026-66195

Affected Vendors & Products

Vendor	Product	Version / Range
clipbucket	clipbucket	5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

ClipBucket V5's web installer does not properly validate or escape the php_cli_filepath parameter before using it in shell execution. This allows unauthenticated attackers to send a malicious POST request with a crafted php_cli_filepath value, enabling arbitrary command execution as the web server user.

Detection Guidance

Check if ClipBucket V5's web installer is accessible on your network. Look for POST requests to the installer endpoint containing the php_cli_filepath parameter. Monitor for unexpected command execution by the web server user.

Impact Analysis

An attacker could exploit this to take full control of the server running ClipBucket V5, steal sensitive data, install malware, or disrupt services. Since the attack requires no authentication, any exposed ClipBucket V5 installer is at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face fines or penalties for failing to secure systems against such exploits.

Mitigation Strategies

Immediately remove or restrict access to the ClipBucket V5 web installer. Ensure the installer is not exposed to untrusted networks. Apply patches or updates if available from the vendor.

Hi! I’m here to help you understand CVE-2026-80138. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70