CVE-2025-62715: Oxygenz Clipbucket XSS Vulnerability

CVE-2025-62715 Overview

CVE-2025-62715 is a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket v5, an open source video sharing platform maintained by Oxygenz. The flaw resides in the Collection tags feature. An authenticated user with normal privileges can create a tag containing HTML or JavaScript payloads. The application later renders these tags unescaped on collection detail pages and tag-list pages. As a result, arbitrary JavaScript executes in the browser of any user who views the affected pages, including administrators. The issue affects versions 5.5.2-#147 and below and is fixed in 5.5.2-#152. The vulnerability is categorized under CWE-79.

Critical Impact
Any authenticated user can inject JavaScript that runs in every viewer's browser, enabling session theft, account takeover, and administrator compromise.

Affected Products

Oxygenz ClipBucket v5, version 5.5.2-#147 and earlier
Collection tags feature within ClipBucket's back office
Tag-list and collection detail pages rendering user-supplied tag content

Discovery Timeline

2025-11-04 - CVE-2025-62715 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62715

Vulnerability Analysis

The vulnerability stems from missing output encoding in ClipBucket's Collection tags feature. Authenticated users can submit tags containing raw HTML or JavaScript through the collection creation workflow. When another user later browses a collection detail page or a tag-list page, the server renders the stored tag data directly into the page markup without HTML entity encoding. Browsers parse the injected content as executable script rather than as text.

Because the payload is persistent, exploitation does not require the attacker to interact with the victim beyond convincing them to visit the affected page. An administrator viewing a poisoned collection triggers execution in the context of the administrative session. Attackers can use this primitive to steal session cookies, perform actions on behalf of the victim, or pivot to further server-side compromise through the admin interface.

Root Cause

The root cause is the use of unsafe template rendering for user-controlled tag values. In the admin collection manager template, the available_tags variable was serialized into JavaScript using only a single-quote replacement rather than a JavaScript-safe escape. Additionally, tag content passed to update handlers was not sanitized with the appropriate escaping function before being embedded in HTML output.

Attack Vector

The attack requires network access to the ClipBucket application and a valid low-privileged user account. The attacker creates or edits a collection tag with an HTML or JavaScript payload. When any subsequent user, including administrators, loads the collection detail or tag-list page, the payload executes in their browser session.

php

// Patch excerpt: upload/actions/photo_uploader.php
// Removes unsafe direct assignment prior to sanitized update handling
         die();
 
     case 'update_photo':
-        $_POST['photo_title'] = mysql_clean($_POST['photo_title']);
-        $_POST['photo_description'] = mysql_clean($_POST['photo_description']);
         CBPhotos::getInstance()->update_photo();
 
         if (error()) {
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

text

// Patch excerpt: upload/admin_area/styles/cb_2014/layout/collection_manager.html
// Switches from a naive quote replacement to a JavaScript-safe escape filter
 <script>
-    var available_tags = JSON.parse('{$available_tags|json_encode|replace:"'": "\'"}');
+    var available_tags = JSON.parse('{$available_tags|json_encode|escape:'javascript'}');
     var id_input = 'tags';
 </script>
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

Detection Methods for CVE-2025-62715

Indicators of Compromise

Collection tag values containing HTML elements such as <script>, <img onerror=, or <svg onload=
Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading collection or tag-list pages
Unexpected administrative actions performed shortly after an admin viewed a user-created collection

Detection Strategies

Query the ClipBucket database for tag records containing angle brackets, JavaScript event handlers, or protocol handlers such as javascript:
Review web server access logs for POST requests to collection or tag creation endpoints containing URL-encoded script tokens
Inspect Content Security Policy violation reports if CSP is enabled on the ClipBucket frontend

Monitoring Recommendations

Enable web application firewall rules that flag script-like patterns in tag submission parameters
Alert on new tag creation events from accounts that have never previously interacted with the collections feature
Monitor administrator session activity for anomalous API calls following visits to user-generated content pages

How to Mitigate CVE-2025-62715

Immediate Actions Required

Upgrade ClipBucket v5 to version 5.5.2-#152 or later, which contains the official fix
Audit the tags database table and delete any existing entries that contain HTML markup or script content
Rotate administrator session cookies and credentials if any suspicious tag content is discovered

Patch Information

The fix is delivered in ClipBucket v5 release 5.5.2-#152 via commit 8e3cf79ce2721fbebde68a05a9a1a6319f086bcc. The patch replaces unsafe template rendering with the Smarty escape:'javascript' filter for tag data serialized into JavaScript context and removes redundant unsanitized assignments in the photo update handler. Full details are published in GitHub Security Advisory GHSA-h5f4-wj75-39x3.

Workarounds

Restrict tag creation permissions to trusted user roles until the upgrade is applied
Deploy a Content Security Policy that disallows inline script execution on collection and tag pages
Place the ClipBucket instance behind a web application firewall that filters common XSS payloads in POST bodies

bash

# Example CSP header to restrict inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";