CVE-2025-21623

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21623
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/MacWarrior/clipbucket-v5/commit/75d663f010cd8569eb9e278f030838174fb30188 Patch
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr Exploit Vendor Advisory
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:*
History

05 Sep 2025, 16:34

Type Values Removed Values Added
Summary
  • (es) ClipBucket V5 ofrece alojamiento de videos de código abierto con PHP. Antes de la versión 5.5.1 - 238, ClipBucket V5 permite a atacantes no autenticados cambiar el directorio de plantillas a través de un directory traversal, lo que da como resultado una denegación de servicio.
CPE cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:*
First Time Oxygenz clipbucket
Oxygenz
References () https://github.com/MacWarrior/clipbucket-v5/commit/75d663f010cd8569eb9e278f030838174fb30188 - () https://github.com/MacWarrior/clipbucket-v5/commit/75d663f010cd8569eb9e278f030838174fb30188 - Patch
References () https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr - () https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr - Exploit, Vendor Advisory

07 Jan 2025, 17:15

Type Values Removed Values Added
References () https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr - () https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr -

07 Jan 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-07 16:15

Updated : 2025-09-05 16:34

NVD link : CVE-2025-21623

Mitre link : CVE-2025-21623

CVE.ORG link : CVE-2025-21623

JSON object : View

Products Affected

oxygenz

  • clipbucket
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-306

Missing Authentication for Critical Function