CVE-2025-62429

    Dashboard / Vulnerabilities / CVE-2025-62429

    CVE-2025-62429

    Published: 20 Oct 2025Last Modified: 10 Oct 2026

    Summary: ClipBucket v5 executes arbitrary PHP code

    Details: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tags and executed. Proper sanitization is not performed, and by injecting malicious code an attacker can execute arbitrary PHP code. This allows an attacker to achieve RCE. This issue has been resolved in version 5.5.2 #147.

    References: https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23147, https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62429.json, https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3x4g-x3gv-rjmq, https://nvd.nist.gov/vuln/detail/CVE-2025-62429, https://github.com/MacWarrior/clipbucket-v5/commit/e81bac602c871bb1ad971884003a3a496a2ab50b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 474978eb99ef1d01c894019f253f97b76eceb7e7
    Fixed -97b02b8cb780abb1fe21a6c1b1fa39238a559a19

    Affected versions

    < 5.5.2 #147

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-62429 | CVE-DB