High severity · published Oct 20, 2025
CVE-2025-62429
ClipBucket v5 executes arbitrary PHP code
7.2
CVSS
0.8%
EPSS
No
On KEV
Description
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tags and executed. Proper sanitization is not performed, and by injecting malicious code an attacker can execute arbitrary PHP code. This allows an attacker to achieve RCE. This issue has been resolved in version 5.5.2 #147.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
clipbucket-v5 · MacWarrior
< 5.5.2 #147 · source: vendor
CL
Clipbucket · Oxygenz
5.3 before 5.5.2-147 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62429
Patch
https://github.com/MacWarrior/clipbucket-v5/commit/e81bac602c871bb1ad971884003a3a496a2ab50b
Release Notes
https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23147
Exploit
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3x4g-x3gv-rjmq
More from clipbucket-v5
9.8
CVE-2026-80138
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter
9.8
CVE-2026-45060
ClipBucket: Blind SQL Injection in progress_video.php
9.8
CVE-2026-42846
ClipBucket: Remote Play URL Command Injection
9.8
CVE-2026-21875
ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments
9.8
CVE-2025-21624
ClipBucket V5 Playlist Cover File Upload to Remote Code Execution