CVE-2026-80138: ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter
Published Aug 25, 2026
·Updated
ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server user.
Affected Software
1 affected component
ClipBucket>=5.5.1<=5.5.3-#153
Event History
Aug 25, 2026
CVE Published
via MITRE·10:12 PM
Data Sourced
via MITRE·10:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What privileges would an attacker have after successful exploitation?
Commands execute as the web server user. The resulting access level is therefore limited to the permissions granted to that account.
2
What request path is involved in exploitation?
The issue is triggered by submitting a crafted POST request to the web installer with a malicious php_cli_filepath parameter.