CVE-2025-64338

critical

ClipBucket v5 is an open source video sharing platform.

Vendor / product: Oxygenz — clipbucket

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Manage Photos feature vulnerable to Stored XSS. The payload is rendered unsafely in the Admin → Manage Photos interface, causing it to execute in the administrator’s browser, therefore allowing an attacker to target administrators and perform actions with elevated privileges. This issue is fixed in version 5.5.2 - #157.

CVSS

9.0

9.0 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2025-11-07 05:16

Modified: 2026-10-07 21:10

NVD status: Analyzed

Last synced 3 days ago

Verified against the source API 2026-10-27 07:06 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

oxygenz / clipbucket ≥5.3 <5.5.2-157

Weakness classification (CWE)

CWE-79 CWE-269

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-93rh-fxxx-j38j

Patch / mitigation: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

References

https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bc... security-advisories@github.com
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-93rh-fxxx-j38j security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores