CVE-2025-55912 Details
Description
An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler
A vulnerability exists in ClipBucket versions through 5.5.0, allowing unauthenticated users to upload arbitrary files via the plupload endpoint in photo_uploader.php. This issue arises from inadequate access controls, enabling the upload of executable PHP files that could be executed remotely, resulting in a full server compromise.
Users are advised to update to ClipBucket version 5.5.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 18, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| oxygenz clipbucket | <= 5.5.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2025 | Reanalysis | [email protected] |
| Sep 25, 2025 | Initial Analysis | [email protected] |
| Sep 18, 2025 | CVE Modified | CISA-ADP |
| Sep 18, 2025 | New CVE Received | [email protected] |