CVE-2025-64339: Oxygenz Clipbucket Stored XSS Vulnerability

CVE-2025-64339 Overview

CVE-2025-64339 is a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket v5, an open source video sharing platform maintained by Oxygenz. The flaw affects versions 5.5.2-#146 and below within the Manage Playlists feature. An authenticated low-privileged user can create a playlist whose name contains HTML or JavaScript. The application renders the playlist name unescaped on both playlist detail and listing pages. Any viewer, including administrators, executes the injected script in their browser. The issue is fixed in version 5.5.2-#147 and is tracked as [CWE-79].

Critical Impact
Attackers with low-privileged accounts can hijack administrator sessions, exfiltrate cookies, or perform authenticated actions in the context of any user who views the malicious playlist.

Affected Products

Oxygenz ClipBucket v5, version 5.5.2-#146
Oxygenz ClipBucket v5, all prior 5.x releases
Fixed in Oxygenz ClipBucket v5, version 5.5.2-#147

Discovery Timeline

2025-11-07 - CVE-2025-64339 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64339

Vulnerability Analysis

The vulnerability is a stored XSS in the Manage Playlists feature of ClipBucket v5. The Playlist Name field accepts arbitrary input from authenticated users without applying HTML output encoding. When the playlist is rendered on detail and listing pages, the name is written directly into the page markup. Any script embedded in the name executes in the viewer's browser under the origin of the ClipBucket application. Because administrators routinely browse playlist listings, a low-privileged attacker can pivot to administrator-level session compromise. This is a persistent injection, so a single malicious playlist can trigger execution repeatedly for every viewer.

Root Cause

The root cause is missing output escaping of user-controlled data in template rendering paths that display playlist metadata. The commit that resolves the issue applies mysql_clean server-side to related photo fields and switches template output for tag data from a naive quote replacement to Smarty's escape:'javascript' filter. The pattern shows the codebase had inconsistent escaping between input handling and template rendering, leaving several fields including playlist names exposed.

Attack Vector

Exploitation requires an authenticated account with permission to create or edit playlists. The attacker submits a playlist name containing an HTML or JavaScript payload, for example a <script> element or an event handler on an image tag. The server stores the value and later injects it verbatim into the HTML sent to any user who visits the playlist listing or detail page. The payload runs with the victim's session cookies and permissions, enabling account takeover, CSRF-style actions, or malicious redirection.

php

// Security patch: upload/actions/photo_uploader.php
// Related fields are now sanitized via mysql_clean before persistence.
    case 'update_photo':
-        $_POST['photo_title'] = mysql_clean($_POST['photo_title']);
-        $_POST['photo_description'] = mysql_clean($_POST['photo_description']);
        CBPhotos::getInstance()->update_photo();

        if (error()) {
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

text

// Security patch: upload/admin_area/styles/cb_2014/layout/collection_manager.html
// Switches from a fragile quote-replace to Smarty's JavaScript escape filter.
{include file="$style_dir/blocks/pagination.html"}

<script>
-    var available_tags = JSON.parse('{$available_tags|json_encode|replace:"'": "\'"}');
+    var available_tags = JSON.parse('{$available_tags|json_encode|escape:'javascript'}');
    var id_input = 'tags';
</script>
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

Detection Methods for CVE-2025-64339

Indicators of Compromise

Playlist records whose name column contains <, >, script, onerror, onload, or javascript: substrings.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after visiting playlist pages.
Unexpected administrative actions (user role changes, new admin accounts, plugin uploads) originating from valid admin sessions.
New or modified playlists created by low-privileged accounts immediately preceding suspicious admin activity.

Detection Strategies

Query the ClipBucket database for playlist name fields containing HTML tag characters or JavaScript keywords.
Inspect web server access logs for POST requests to playlist creation and edit endpoints with payload bodies containing script markers.
Review Content Security Policy violation reports if CSP is deployed in report-only or enforce mode.
Correlate low-privilege user activity with subsequent administrator session anomalies in identity and access logs.

Monitoring Recommendations

Enable web application firewall rules that flag <script, onerror=, and javascript: patterns in playlist parameters.
Alert on creation of administrator accounts or privilege changes that follow visits to user-generated content pages.
Ingest ClipBucket application and web server logs into a centralized log platform for retention and behavioral analysis.
Track browser telemetry from administrator workstations for unexpected script execution against the ClipBucket origin.

How to Mitigate CVE-2025-64339

Immediate Actions Required

Upgrade ClipBucket v5 to version 5.5.2-#147 or later without delay.
Audit the playlists table for entries containing HTML or JavaScript and remove or sanitize offending records.
Force logout and password rotation for administrator accounts that accessed playlist pages while the vulnerable version was deployed.
Review recent administrative changes (users, roles, plugins) for actions that may have been executed via injected script.

Patch Information

The fix is delivered in ClipBucket v5 5.5.2-#147. See the ClipBucket v5 GitHub Security Advisory GHSA-c695-m4g4-v3fv and the corresponding upstream fix commit. The patch introduces server-side sanitization via mysql_clean on related fields and applies the Smarty escape:'javascript' filter to values embedded in inline scripts.

Workarounds

Restrict playlist creation and editing to trusted user roles until the upgrade is applied.
Deploy a Content Security Policy that disallows inline scripts to reduce the impact of stored payloads.
Place a web application firewall in front of ClipBucket to block HTML and JavaScript patterns in playlist name parameters.
Temporarily hide the playlist listing and detail pages from administrative navigation to reduce administrator exposure.

bash

# Example WAF rule (ModSecurity) to block script markers in playlist name parameters
SecRule ARGS_NAMES "@rx (?i)playlist.*name" \
    "chain,id:1064339,phase:2,deny,status:403,\
    msg:'CVE-2025-64339: possible stored XSS in ClipBucket playlist name'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"