CVE-2025-62424: Oxygenz Clipbucket Path Traversal Flaw

CVE-2025-62424 Overview

ClipBucket, a web-based video-sharing platform maintained by Oxygenz, contains a path traversal vulnerability in the /admin_area/template_editor.php endpoint. Versions 5.5.2 - #146 and earlier fail to properly validate the folder (dir) parameter used for loading template files. Authenticated administrators can inject path traversal sequences to read and write arbitrary files outside the intended template directory. Exploitation allows disclosure of sensitive files such as /etc/passwd and modification of writable files on the host, which can lead to application or server compromise. The issue is tracked under [CWE-22] and fixed in version 5.5.2 - #147.

Critical Impact
Authenticated administrators can read and overwrite arbitrary files on the ClipBucket server, enabling sensitive data disclosure and potential full application compromise.

Affected Products

Oxygenz ClipBucket v5 up to and including release 5.5.2 - #146
ClipBucket administrative component upload/admin_area/template_editor.php
Deployments exposing the /admin_area/ interface to administrator accounts

Discovery Timeline

2025-10-17 - CVE-2025-62424 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62424

Vulnerability Analysis

The vulnerability resides in upload/admin_area/template_editor.php, which loads template files based on a user-supplied dir request parameter. The original code assigned $sel_dir = $_GET['dir'] and only verified the value against is_template() when the parameter was truthy, without normalizing path components. As a result, an authenticated administrator can supply values containing ../ sequences to escape the templates directory and reach arbitrary paths on the filesystem. Because the template editor exposes both read and write operations, the flaw allows sensitive file disclosure such as /etc/passwd and modification of any file writable by the web server user. Overwriting a PHP file inside the ClipBucket web root can escalate the primary impact into remote code execution under the web server account.

Root Cause

The root cause is inadequate validation of the folder path used by the template editor. The application trusted the dir parameter and did not canonicalize the path or restrict it to the templates directory prior to file I/O, a classic path traversal weakness classified as [CWE-22].

Attack Vector

Exploitation is network-based and requires authenticated administrator privileges. An attacker with admin_area access sends crafted HTTP requests to template_editor.php with a dir (or associated file) parameter containing traversal sequences. The server then reads or writes the targeted path relative to the template loader.

php

/**
 * Getting List Of Templates
 */
-$templates = $cbtpl->get_templates();
-
+$templates = CBTemplate::getInstance()->get_templates();
+assign('templates', $templates);
 #Checking if user has selected template for editing, if not, make SELECTED template for editing
-$sel_dir = $_GET['dir'];
-if (!$sel_dir || !$cbtpl->is_template($sel_dir)) {
-    $sel_dir = TEMPLATE;
+$sel_dir = TEMPLATE;
+if (!empty($_GET['dir'])) {
+    if (!CBTemplate::getInstance()->is_template($_GET['dir'])) {
+        e(lang('template_dont_exist'));
+        unset($_GET['file']);
+    } else {
+        $sel_dir = $_GET['dir'];
+    }
+}
+if ($sel_dir == ClipBucket::DEFAULT_TEMPLATE) {
+    e(lang('warning_official_cb_template'),'w');
 }

 //Checking if still there is no template, display error
-if (!$cbtpl->is_template($sel_dir)) {
-    e('No Template Found');
+if (!CBTemplate::getInstance()->is_template($sel_dir)) {
+    e(lang('template_dont_exist'));
 } else {

Source: ClipBucket patch commit c06d0f2

The patch reworks the parameter handling so $sel_dir defaults to the constant TEMPLATE and only accepts the user-supplied dir value after CBTemplate::getInstance()->is_template() confirms it is a registered template. If validation fails, the file parameter is discarded and a template_dont_exist error is returned.

Detection Methods for CVE-2025-62424

Indicators of Compromise

HTTP requests to /admin_area/template_editor.php containing ../, %2e%2e%2f, or absolute paths in the dir or file parameters.
Web server access logs showing template_editor.php requests that return non-template file content, such as /etc/passwd or PHP source outside styles/.
Unexpected modifications to PHP files inside the ClipBucket web root or system files writable by the web server user.
New or altered administrator sessions preceding a burst of template_editor.php requests.

Detection Strategies

Alert on any template_editor.php request whose dir parameter resolves outside the configured template root after URL decoding and normalization.
Baseline legitimate administrator activity for the template editor and flag deviations such as reads of non-.html/.tpl files.
Correlate WAF or reverse-proxy path traversal signatures with authenticated admin sessions to prioritize investigation.

Monitoring Recommendations

Enable verbose access logging on the /admin_area/ path and forward logs to a centralized analytics platform.
Monitor filesystem integrity for the ClipBucket install directory and adjacent system files using host-based file integrity monitoring.
Track administrator authentication events and correlate them with administrative endpoint usage.

How to Mitigate CVE-2025-62424

Immediate Actions Required

Upgrade ClipBucket v5 to release 5.5.2 - #147 or later, which contains the fix in commit c06d0f2.
Rotate credentials for all administrator accounts and review recent admin sessions for unauthorized activity.
Audit files within the web root and system-writable directories for unexpected modifications following the upgrade.

Patch Information

The fix is delivered in ClipBucket v5 release 5.5.2 - #147 via commit c06d0f2e69c9acb008cebbd34fd5f29da3191a28. Full advisory details are available in the GitHub Security Advisory GHSA-3v2p-rfwx-52qj and the upstream patch commit.

Workarounds

Restrict access to /admin_area/ by source IP address using web server ACLs until the patch is applied.
Enforce multi-factor authentication for administrator accounts to reduce the risk of credential compromise enabling exploitation.
Deploy a web application firewall rule that blocks path traversal sequences in the dir and file parameters of template_editor.php.
Run the PHP process under a least-privilege account that cannot write to sensitive system files.

bash

# Example nginx rule to block path traversal in template_editor.php parameters
location = /admin_area/template_editor.php {
    if ($args ~* "(\.\./|%2e%2e%2f|/etc/|/proc/)") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}