ClipBucket v5 Path Traversal to RCE via Template Editor (CVE-2026-100372)

CVE-2026-100372 - Path Traversal Vulnerability in ClipBucket v5 Vulnerability Overview A path traversal vulnerability exists in ClipBucket v5 5.5.3 - #182 within the Template Editor feature. Due to insufficient validation of user-controlled paths, authenticated administrators can manipulate the and parameters to access files outside the template directory. This allows for arbitrary file read and write operations, which can be escalated to Remote Code Execution (RCE) by overwriting PHP files. Impact Scope Affected Versions: ClipBucket v5 5.5.3 - #182 Affected Endpoint: Impact: - Authenticated administrators can escape the expected Template Editor directory. - Any file accessible by the application can be read. - Writable files can be overwritten. - RCE can be achieved by overwriting executable PHP files (such as ) with attacker-controlled PHP code. - This may lead to the complete compromise of the ClipBucket application and potentially the underlying server. Remediation Patch submission: here Exploitation Chain POC Exploitation Steps 1. Log in to ClipBucket using an administrator account with access to the Template Editor. 2. Access the Template Editor feature: 3. Use path traversal to point to outside the template directory by setting the following parameters: 4. Provide attacker-controlled PHP content as the file content and save the template. 5. The application writes the provided content to . 6. Access a page that loads the modified . 7. Observe the injected PHP code being executed by the server, demonstrating RCE. Example POC Code After successfully overwriting , request a page containing this file to observe command output in the HTTP response.

Goal Reached Thanks to every supporter — we hit 100%!

ClipBucket v5 Path Traversal to RCE via Template Editor (CVE-2026-100372)