CVE-2025-21624 - CVE House

Back to Database

Status published Critical CVE-2025-21624

ClipBucket V5 Playlist Cover File Upload to Remote Code Execution

9.8 CVSS

Vulnerability Description

ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks, an attacker can upload a PHP script file instead of an image file, thus allowing a webshell or other malicious files to be stored and executed on the server. This attack vector exists in both the admin area and low-level user area. This vulnerability is fixed in 5.5.1 - 239.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-21624

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from MacWarrior

View All →

ClipBucket v5 Unauthenticated Object Flagging Vulnerability

ClipBucket v5: Stored XSS Vulnerability in Manage Playlists

ClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection Name

ClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title

ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin

Affected Vendor

MacWarrior

View all reports →

Affected Software

clipbucket-v5

Vulnerable Versions:

< 5.5.1 - 239

Timeline

Official Publish: January 7th, 2025

Last Modified: January 7th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation