A critical OS command injection flaw in ClipBucket V5's web installer lets unauthenticated attackers run arbitrary commands as the web server user via a crafted POST request.
What Is It
CVE-2026-80138 is an OS command injection vulnerability (CWE-78) in ClipBucket V5, the open-source video-sharing platform maintained by MacWarrior. The product's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. An unauthenticated attacker can submit a crafted POST request to the installer containing a malicious php_cli_filepath value and execute arbitrary commands in the context of the web server user.
The issue was disclosed by VulnCheck, which assigned a CVSS v3.1 base score of 9.8 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A secondary CVSS v4.0 score of 9.2 (CRITICAL) was also published; operators who need the v4.0 metric breakdown should read it directly from the VulnCheck advisory rather than infer it from the v3.1 vector, as the two scoring systems use different metric sets.
Why It Matters
Every exploitability factor works in the attacker's favor: the attack is remotely reachable over the network, requires low complexity, needs no privileges, and requires no user interaction. Impact is high across confidentiality, integrity, and availability. Command execution as the web server user is a direct foothold on the host; no chaining required.
Because the vulnerable code path lives in the installer, exposure depends on whether installer files remain reachable after deployment, a common oversight on self-hosted web applications.
What's Vulnerable
- Vendor/Product: MacWarrior,
clipbucket-v5 - Affected versions: 5.5.1 through 5.5.3-#153 (inclusive)
- Default status for other versions: unaffected
- Relevant code:
upload/cb_install/functions_install.phpandupload/includes/classes/system.class.php
Patch Status
No CISA KEV entry accompanies this record, so there is no confirmation of active exploitation and no federally mandated remediation deadline at this time. NVD status is "Received" as of publication on 2026-08-25, meaning analysis is still pending.
Upstream commit 36e7c6cfd81f62a091d2aeef96a8fc2fc2d85dc4 is referenced in the advisory as the associated code change. Operators running any version in the 5.5.1 through 5.5.3-#153 range should update past the affected range and verify installer files are not publicly reachable.