CVE-2026-77929: ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint
ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function in fileupload.class.php fails to update the file extension after MIME validation, allowing an attacker-controlled .php extension to persist on disk and execute as PHP via PHP-FPM when the uploaded file is retrieved.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ClipBucketto a version that resolves this vulnerability.Fixed in 5.5.3-#182 - Compensating control
Restrict access to the photo upload endpoint to trusted/authenticated users and apply network-layer controls (e.g., IP allowlisting/WAF rules) to reduce exposure of the vulnerable upload functionality.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated ClipBucket user who can use the photo upload endpoint can exploit it. No user interaction is required.
What does an attacker need to upload?
The attacker needs to upload a file with a .php extension that also contains valid image magic bytes, allowing it to pass MIME validation while retaining the PHP extension on disk.
Under what deployment condition does uploaded code execute?
Execution occurs when the uploaded file is retrieved in an environment where PHP-FPM processes the retained .php file as PHP.
Which versions are affected and what is the available fix?
ClipBucket v5 releases before 5.5.3-#182 are affected. Upgrade to 5.5.3-#182 or later.