CVE-2025-55911 Details
Description
An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter
A server-side request forgery (SSRF) vulnerability has been identified in ClipBucket version 5.5.2 Build #90. This issue allows authenticated low-privileged users to execute arbitrary code by exploiting the 'file' parameter in 'upload/actions/file_downloader.php'. The vulnerability arises because the application fails to properly validate or restrict URLs, enabling attackers to make the server connect to internal resources or cloud metadata endpoints.
To address this vulnerability, validate and restrict the 'file' parameter to allow only known safe hosts. Implement an allowlist, block private IP ranges and cloud metadata addresses, and ensure that only HTTP or HTTPS schemes are permitted. Additionally, apply network egress rules to prevent the application from initiating connections to internal service ranges.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 18, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://medium.com/@mukund.s1337/cve-2025-55911-clipbucket-5-5-2-build-90-ssrf-via-upload-actions-file-downloader-php-eb49dc02bd6f | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| oxygenz clipbucket | < 5.5.2-90 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2025 | Reanalysis | [email protected] |
| Sep 25, 2025 | Initial Analysis | [email protected] |
| Sep 18, 2025 | CVE Modified | CISA-ADP |
| Sep 18, 2025 | New CVE Received | [email protected] |