CVE-2025-21624
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-21624
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21624.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-21624
- Aliases
-
- GHSA-98vm-2xqm-xrcc
- Published
- 2025-01-07T15:46:11Z
- Modified
- 2025-10-20T20:30:03.253493Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- ClipBucket V5 Playlist Cover File Upload to Remote Code Execution
- Details
-
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239.
- Database specific
{ "cwe_ids": [ "CWE-434" ] }- References