CVE-2025-64336: Oxygenz Clipbucket Stored XSS Vulnerability

CVE-2025-64336 Overview

CVE-2025-64336 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in ClipBucket v5, an open source video sharing platform maintained by Oxygenz. The flaw affects the Manage Photos feature in versions 5.5.2-#146 and below. An authenticated regular user can upload a photo with a malicious Photo Title containing HTML or JavaScript. The payload does not execute in the user-facing gallery, but the Admin → Manage Photos view renders it unsafely. When an administrator opens the panel, the injected script executes in the administrator's browser session. The issue is fixed in version 5.5.2-#147.

Critical Impact
A low-privileged authenticated user can execute arbitrary JavaScript in an administrator's browser, enabling session theft, account takeover, or backend administrative actions.

Affected Products

Oxygenz ClipBucket v5, versions 5.5.2-#146 and below
ClipBucket v5 back office Manage Photos component (upload/actions/photo_uploader.php)
ClipBucket v5 collection manager template (upload/admin_area/styles/cb_2014/layout/collection_manager.html)

Discovery Timeline

2025-11-07 - CVE-2025-64336 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64336

Vulnerability Analysis

The vulnerability is a stored XSS in the ClipBucket v5 photo upload workflow. When an authenticated user uploads a photo, the photo_title field is stored without sufficient contextual output encoding for administrative views. The user-facing gallery escapes or filters the payload well enough to prevent execution, which conceals the flaw during normal browsing. The Admin → Manage Photos section renders the same stored value into the HTML response without escaping, causing the browser to interpret injected <script> or event-handler markup. Because administrators typically hold session privileges to modify content, users, and configuration, script execution in that context is equivalent to administrative account compromise.

Root Cause

The root cause is missing or inadequate output encoding when the stored photo_title value is emitted in the admin templates. The patch removes reliance on mysql_clean() at the controller layer and, in related template code, replaces a fragile inline serialization pattern with json_encode|escape:'javascript' to enforce safe JavaScript-context encoding. The fix reflects the standard guidance that input sanitization is not a substitute for context-aware output escaping.

Attack Vector

Exploitation requires an authenticated regular user account and administrator interaction. The attacker uploads a photo, sets the Photo Title to a JavaScript payload, and waits for an administrator to view the Manage Photos section. Because the attack is delivered through normal application functionality, no network position or elevated privileges are needed beyond a valid low-privileged account.

php

// Patch excerpt: upload/actions/photo_uploader.php
    case 'update_photo':
-        $_POST['photo_title'] = mysql_clean($_POST['photo_title']);
-        $_POST['photo_description'] = mysql_clean($_POST['photo_description']);
        CBPhotos::getInstance()->update_photo();

        if (error()) {
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

text

{* Patch excerpt: upload/admin_area/styles/cb_2014/layout/collection_manager.html *}
<script>
-    var available_tags = JSON.parse('{$available_tags|json_encode|replace:"'": "\'"}');
+    var available_tags = JSON.parse('{$available_tags|json_encode|escape:'javascript'}');
    var id_input = 'tags';
</script>
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

Detection Methods for CVE-2025-64336

Indicators of Compromise

Photo records whose photo_title field contains <script, onerror=, onload=, javascript:, or encoded variants such as <script.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the Manage Photos page.
New administrator accounts, permission changes, or content modifications performed from an administrator session with no corresponding manual action.

Detection Strategies

Scan the ClipBucket database photos table for HTML control characters or script tokens in the photo_title and photo_description columns.
Review web server access logs for POST requests to upload/actions/photo_uploader.php with case=update_photo or case=upload_photo originating from non-administrator accounts.
Correlate administrator visits to /admin_area/manage_photos.php with anomalous outbound HTTP requests to unfamiliar hosts.

Monitoring Recommendations

Enable and archive PHP application logs and web server access logs to support retrospective hunting for photo upload activity.
Deploy a Content Security Policy (CSP) in report-only mode against admin pages to surface inline script execution attempts.
Alert on privilege changes, new admin account creation, and configuration edits within short time windows after Manage Photos page loads.

How to Mitigate CVE-2025-64336

Immediate Actions Required

Upgrade ClipBucket v5 to version 5.5.2-#147 or later on all instances.
Audit the photos table and quarantine or sanitize any records with suspicious photo_title values before administrators access the Manage Photos view.
Rotate administrator session tokens and passwords if evidence of exploitation exists.

Patch Information

The fix is delivered in ClipBucket v5 release 5.5.2-#147. The corrective commit is available in the vendor repository at ClipBucket v5 commit 8e3cf79. Full advisory details are published as GHSA-hjc2-5329-j49w, and the tagged release is documented at ClipBucket v5 release 5.5.2-#147.

Workarounds

Restrict photo upload permissions to trusted user roles until the patch is applied.
Temporarily disable the Manage Photos administrative page or restrict admin panel access by IP allow-list.
Enforce a strict Content Security Policy on administrative routes to block inline script execution.

bash

# Example CSP header for the ClipBucket admin area (nginx)
location /admin_area/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
}