CVE-2025-64338: XSS in ClipBucket Video Sharing Platform

The primary impact of CVE-2025-64338 is the potential for an attacker to compromise the ClipBucket administrator account. By injecting malicious JavaScript into a collection name, an attacker can trigger code execution when an administrator views the 'Manage Photos' page. This could allow the attacker to steal administrator credentials, modify site content, inject malicious scripts into videos, or even gain complete control of the server. The vulnerability’s reliance on authentication limits the initial attack surface, but successful compromise of an administrator account provides a significant blast radius, potentially impacting all users and data stored on the platform. This is similar to other XSS vulnerabilities where attackers leverage administrative interfaces to gain broader control.

1. Reserved2025-10-30
2. Published2025-12-15
3. Modified2025-12-16
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-64338 is to immediately upgrade ClipBucket to version 5.5.2 - #157 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the 'Collection Name' field to prevent the injection of HTML/JavaScript payloads. Web Application Firewalls (WAFs) configured to detect and block XSS attempts targeting the 'Manage Photos' interface can provide an additional layer of defense. Regularly review and audit user-generated content to identify and remove any potentially malicious collection names. After upgrade, confirm the fix by attempting to create a collection with a name containing a simple JavaScript payload (e.g., <script>alert('XSS')</script>) and verifying that it is properly sanitized and does not execute.