Platform
php
Component
clipbucket-v5
Fixed in
5.5.2
CVE-2025-21622 describes a Path Traversal vulnerability discovered in ClipBucket, an open-source video hosting platform built with PHP. This flaw allows an attacker to delete files outside of the intended directory by manipulating the avatar upload URL. The vulnerability impacts ClipBucket versions 5.5.1 and earlier. A patch is available in version 5.5.1 - 237.
The vulnerability lies within ClipBucket's avatar deletion functionality. When a user deletes their avatar, the system checks the provided URL against the 'avatars' directory. Critically, there's no validation to prevent path traversal sequences (e.g., '../') in the user-supplied URL. An attacker can craft a malicious URL containing these sequences, effectively bypassing the intended directory restriction. This allows them to specify arbitrary file paths on the server, leading to unauthorized file deletion. The potential impact extends beyond just avatar files; an attacker could potentially delete critical system files, disrupting the entire ClipBucket installation or even compromising the underlying server. This vulnerability shares similarities with other path traversal exploits where insufficient input validation leads to unauthorized access and modification of files.
CVE-2025-21622 was publicly disclosed on January 7, 2025. Currently, there are no known public proof-of-concept exploits available. The EPSS score is pending evaluation. It is not listed on the CISA KEV catalog at the time of this writing.
Exploit Status
EPSS
1.27% (79% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-21622 is to upgrade ClipBucket to version 5.5.1 - 237 or later, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. One approach is to implement a Web Application Firewall (WAF) rule that blocks requests containing path traversal sequences in the avatar URL. Additionally, restrict file upload permissions to the 'avatars' directory and implement strict input validation on the avatar URL to prevent malicious characters. Regularly review and audit file permissions to ensure they are appropriately configured. After upgrading, confirm the fix by attempting to upload an avatar with a malicious path traversal sequence in the URL; the deletion should be blocked.
Update ClipBucket to version 5.5.1 - 237 or higher. This version fixes the path traversal vulnerability in the avatar deletion function. The update will prevent file deletion outside of the avatars directory.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-21622 is a Path Traversal vulnerability in ClipBucket versions 5.5.1 and earlier, allowing attackers to delete files by manipulating the avatar upload URL.
You are affected if you are running ClipBucket version 5.5.1 or earlier. Upgrade to version 5.5.1 - 237 to resolve the issue.
Upgrade ClipBucket to version 5.5.1 - 237. As a temporary workaround, implement a WAF rule to block requests with path traversal sequences in the avatar URL.
As of January 2025, there are no confirmed reports of active exploitation, but the vulnerability is publicly known.
Refer to the ClipBucket security advisories on their official website or GitHub repository for the latest information and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.