CVE-2025-62430: Oxygenz Clipbucket XSS Vulnerability

CVE-2025-62430 Overview

CVE-2025-62430 is a stored cross-site scripting (XSS) vulnerability in ClipBucket v5, an open source video sharing platform. The flaw affects builds through 5.5.2 #145 and stems from insufficient sanitization of user-supplied metadata fields. Attackers with regular user privileges can inject script payloads into video fields including Tags, Genre, Actors, Producer, Executive Producer, and Director, as well as photo fields Photo Title and Photo Tags. The injected script executes when any visitor, including administrators, views the affected content page. The vendor released a fix in build 5.5.2 #146.

Critical Impact
Injected scripts can issue authenticated fetch requests to admin_area endpoints, exfiltrating administrative content or triggering unintended actions on behalf of any viewing user.

Affected Products

ClipBucket v5 through build 5.5.2 #145
Oxygenz ClipBucket (all prior builds in the v5 branch)
ClipBucket v5 back office collection manager and photo uploader components

Discovery Timeline

2025-10-17 - CVE-2025-62430 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62430

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. ClipBucket v5 accepts user-supplied values in multiple video and photo metadata fields without applying adequate output encoding or input sanitization. A regular authenticated user with permission to edit a video or photo can supply a payload containing a closing delimiter followed by a <script> element. The malicious payload is persisted server-side and rendered when the video or photo page is viewed.

Because the payload runs in the browser context of every viewer, an unauthenticated visitor or a privileged administrator triggers execution simply by loading the affected page. Although session cookies carry the HttpOnly attribute and cannot be read from JavaScript, the injected script uses the browser's authenticated session to issue same-origin fetch requests. This allows the payload to read responses from admin_area endpoints and post state-changing requests when an administrator views the content.

Root Cause

The root cause is missing output encoding in the back office collection manager template and missing input sanitization in the photo update handler. Tag data was serialized into JavaScript context using json_encode with a naive quote replacement, permitting injection of arbitrary script through crafted tag values. In the photo update path, calls to mysql_clean on photo_title and photo_description were structurally insufficient because sanitization was applied at the wrong boundary.

Attack Vector

Exploitation requires a low-privileged account that can edit at least one video or photo. The attacker supplies a payload in a Tags, Movieinfos, Photo Title, or Photo Tags field. The payload is stored and later rendered on the public content page and in administrative interfaces. User interaction is required: a victim must load the page hosting the injected content. Once triggered, the script executes with the origin and session of the victim.

php

// Patch: upload/actions/photo_uploader.php
// Removed insufficient sanitization; fix moved server-side into CBPhotos::update_photo()
     case 'update_photo':
-        $_POST['photo_title'] = mysql_clean($_POST['photo_title']);
-        $_POST['photo_description'] = mysql_clean($_POST['photo_description']);
         CBPhotos::getInstance()->update_photo();

         if (error()) {
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

text

// Patch: upload/admin_area/styles/cb_2014/layout/collection_manager.html
// Apply javascript-context escaping when embedding tags into a <script> block
 <script>
-    var available_tags = JSON.parse('{$available_tags|json_encode|replace:"'": "\'"}');
+    var available_tags = JSON.parse('{$available_tags|json_encode|escape:'javascript'}');
     var id_input = 'tags';
 </script>
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

Detection Methods for CVE-2025-62430

Indicators of Compromise

Video or photo records containing <script>, onerror=, onload=, or javascript: substrings in Tags, Genre, Actors, Producer, Executive Producer, Director, Photo Title, or Photo Tags fields.
Unexpected outbound fetch or XMLHttpRequest traffic from administrator browsers targeting /admin_area/ endpoints shortly after viewing user-generated content.
Web server logs showing content edit requests from low-privileged accounts followed by administrator visits to the same content URL.

Detection Strategies

Query the ClipBucket database for metadata columns containing HTML control characters or script keywords using pattern matching such as LIKE '%<script%' or LIKE '%javascript:%'.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts on video and photo pages.
Correlate edit events from non-administrative users with subsequent administrator page loads in application logs.

Monitoring Recommendations

Alert on any HTTP request to admin_area endpoints that originates via fetch from a video or photo view page referer.
Monitor administrator session activity for anomalous POST requests generated without corresponding UI navigation.
Log and review all update_photo, update_video, and Movieinfos edit actions performed by non-admin accounts.

How to Mitigate CVE-2025-62430

Immediate Actions Required

Upgrade ClipBucket v5 to build 5.5.2 #146 or later, which contains commit 8e3cf79ce2721fbebde68a05a9a1a6319f086bcc.
Audit existing video and photo records for previously injected payloads in Tags, Movieinfos, Photo Title, and Photo Tags fields and remove any malicious content.
Rotate administrator credentials and invalidate active administrative sessions if exploitation is suspected.

Patch Information

The vendor fix is available in ClipBucket v5 build 5.5.2 #146. The patch escapes tag data with the Smarty escape:'javascript' modifier when rendering into script context and relocates photo field sanitization into CBPhotos::update_photo(). See the GitHub Security Advisory GHSA-qrqq-hpf3-9mc9 and the upstream commit for the full change set.

Workarounds

No official workarounds exist; the vendor advisory states patching is the only supported remediation.
As a temporary compensating control, restrict video and photo edit permissions to trusted operators until the upgrade is applied.
Deploy a strict Content Security Policy that disallows inline script execution on public video and photo pages to reduce payload impact.

bash

# Update ClipBucket v5 to the patched build
git clone https://github.com/MacWarrior/clipbucket-v5.git
cd clipbucket-v5
git checkout 8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

# Verify installed build reports 5.5.2 #146 or later before restoring edit permissions