CVE-2025-55912

published 2025-09-18

CVE-2025-55912: An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary…

Priority P2 64 high 7.3 CVSS 3.1

AV N AC L PR N UI N S U C L I L A L

EXPLOIT

An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler

Affected

1 ranges

Vendor	Product	Version range	Fixed in
oxygenz	clipbucket	<= 5.5.0	—

Detection & IOCs extracted from sources · hover to see the quote

path /files/photos/shell.php↗

url http://victim.com/files/photos/shell.php?cmd=id↗

filename shell.php↗

path photo_uploader.php↗

• → Monitor for unauthenticated POST requests to the plupload endpoint at photo_uploader.php — any file upload to this path without a valid session should be treated as malicious. ↗
• → Alert on the presence of PHP files (e.g., .php extensions) appearing under the /files/photos/ directory, which is the upload destination for the vulnerable endpoint. ↗
• → Detect web requests to /files/photos/*.php with query parameters such as ?cmd= which indicate webshell execution following a successful upload. ↗

• · The vulnerability affects ClipBucket version 5.5.0 and all prior versions; the missing access control is specific to the plupload handler in photo_uploader.php. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434