External risk intelligence

ClipBucket V5 Installer Remote Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-80138

The vulnerability exists within the web installer component of ClipBucket, a web application. Web installers are designed to be accessed via a web browser during the setup phase of an application, which is commonly performed on internet-facing web servers or externally reachable infrastructure during initial deployment.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the web installer of ClipBucket, a platform that allows users to create their own video-sharing websites. This issue could allow unauthorized individuals to execute commands on the server hosting the ClipBucket application, potentially leading to a compromise of the system. The main concern is to confirm if this software is in use and assess any potential exposure.

Unauthenticated access to execute server commands.
Affects web platforms that manage user-uploaded content.
Confirm if ClipBucket is deployed and assess risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target the web installer of ClipBucket V5. By sending a specially crafted POST request containing a malicious value for the `php_cli_filepath` parameter, the attacker can trick the installer into executing arbitrary commands on the server, with the same permissions as the web server user.

No authentication required.
Installer accepts malicious input.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

The web installer for ClipBucket could allow attackers to execute arbitrary commands as the web server user when a crafted POST request is sent to the installer. This could impact the integrity of the web server.

Server command execution.
Via crafted POST request.
Server integrity impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ClipBucket's web installer requires immediate attention from the teams responsible for web application deployments and security. The first critical step is to locate all instances of the affected technology, determine their business criticality and external reachability, and identify the accountable system owners before planning remediation.

Identify and triage affected installations.
Confirm external exposure and business impact.
Coordinate remediation with application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ClipBucket V5?

ClipBucket V5 is an open-source software platform used to build and manage video-sharing websites. It provides the framework for hosting, processing, and displaying user-uploaded media content. It is typically deployed on web servers using PHP and a database, functioning much like a private or community-driven video streaming service.

What does CVE-2026-80138 mean for my security?

This vulnerability is an OS command injection, classified as CWE-78. It means the application fails to filter data before using it to run system-level commands. Because of this, the software inadvertently allows an attacker to inject their own instructions into the server's operating system, which the server then executes as if they were legitimate commands from the software itself.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted POST request to the application's web installer. The request includes a malicious value for the 'php_cli_filepath' parameter, which the installer processes without proper validation. It is important to note that this is not triggered by standard browsing or regular site usage; it specifically targets the initial setup component of the application.

Why is this considered an external risk?

Halo Surface Signal flags this as an external risk because the vulnerability exists within a web installer, which is designed to be accessible via a browser. When ClipBucket is hosted on internet-facing infrastructure during deployment, the installer endpoint becomes reachable by anyone on the internet, allowing unauthenticated attackers to attempt this command execution remotely.

What is the first step to address this CVE?

Your first step is to perform an inventory of all web servers in your environment to identify any instances where ClipBucket V5 is installed. Once you have located these instances, confirm whether they are currently exposed to the internet or are only accessible internally. Identifying these assets and their business owners is essential before coordinating the necessary security updates or removing the vulnerable installer component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.