ClipBucket's Manage Photos Functie is Kwetsbaar voor Stored XSS via Collectienaam

The primary impact of CVE-2025-64338 is the potential for an attacker to compromise the ClipBucket administrator account. By injecting malicious JavaScript into a collection name, an attacker can trigger code execution when an administrator views the 'Manage Photos' page. This could allow the attacker to steal administrator credentials, modify site content, inject malicious scripts into videos, or even gain complete control of the server. The vulnerability’s reliance on authentication limits the initial attack surface, but successful compromise of an administrator account provides a significant blast radius, potentially impacting all users and data stored on the platform. This is similar to other XSS vulnerabilities where attackers leverage administrative interfaces to gain broader control.

Organizations and individuals using ClipBucket v5 for video sharing, particularly those with multiple administrators or limited security awareness, are at risk. Shared hosting environments where multiple users share the same ClipBucket instance are also at increased risk, as a compromised user could potentially target other administrators.

• php: Examine ClipBucket's database for collection names containing suspicious HTML or JavaScript code. Use grep to search the collection_name field in the relevant table for <script> tags or other potentially malicious patterns.

grep '<script' /path/to/clipbucket/db/collection_table.sql

• generic web: Monitor access logs for requests to the 'Manage Photos' interface with unusual parameters or user agents. Look for POST requests to the collection creation endpoint with potentially malicious data.

curl -X POST -d "collection_name=<script>alert('XSS')</script>" http://your-clipbucket-site/admin/manage_photos.php > /dev/null 2>&1

• generic web: Check response headers for signs of XSS, such as the presence of JavaScript code in the Content-Security-Policy (CSP) header.

1. 2025-12-15Disclosure

   disclosure

1. Gereserveerd2025-10-30
2. Gepubliceerd2025-12-15
3. Gewijzigd2025-12-16
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-64338 is to immediately upgrade ClipBucket to version 5.5.2 - #157 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the 'Collection Name' field to prevent the injection of HTML/JavaScript payloads. Web Application Firewalls (WAFs) configured to detect and block XSS attempts targeting the 'Manage Photos' interface can provide an additional layer of defense. Regularly review and audit user-generated content to identify and remove any potentially malicious collection names. After upgrade, confirm the fix by attempting to create a collection with a name containing a simple JavaScript payload (e.g., <script>alert('XSS')</script>) and verifying that it is properly sanitized and does not execute.