CVE-2026-100372: ClipBucket Path Traversal Vulnerability

CVE-2026-100372 Overview

CVE-2026-100372 is a path traversal vulnerability [CWE-22] in ClipBucket v5 versions prior to 5.5.3-#197. The flaw exists in the admin template editor (upload/admin_area/template_editor.php) and allows authenticated administrators with manage_template_access permission to overwrite arbitrary PHP files on the server. Attackers supply directory traversal sequences through the folder parameter to escape the intended layout directory. Writing attacker-controlled content into executable PHP files yields remote code execution under the web server account.

Critical Impact
Authenticated administrators can overwrite PHP files outside the template directory and achieve remote code execution as the web server user, leading to full application compromise.

Affected Products

ClipBucket v5 versions before 5.5.3-#197
upload/admin_area/template_editor.php component
Deployments where administrators hold the manage_template_access permission

Discovery Timeline

2026-09-25 - CVE-2026-100372 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100372

Vulnerability Analysis

The template editor in ClipBucket v5 permits an authenticated administrator to select template files to read and edit through a folder parameter. The editor fails to constrain this parameter to the intended layout directory. An attacker injects ../ sequences to reach any writable path accessible to the web server process.

Because the editor saves user-supplied content without restricting the file extension on write, attackers can overwrite PHP source files that the application later executes. The result is remote code execution in the context of the web server user, typically www-data or similar.

Root Cause

The root cause is insufficient input validation on both the directory parameter and the file extension. The vulnerable code uses a permissive regular expression that captures any extension from the file parameter rather than enforcing an allow-list. Combined with the missing path canonicalization on folder, the editor treats any filesystem location as a valid template target.

Attack Vector

Exploitation requires an authenticated session with manage_template_access privileges. The attacker issues a crafted request to the template editor endpoint, supplying traversal sequences in the folder parameter and a target PHP file name in file. The editor then reads, allows modification of, and writes to the attacker-chosen path. Loading the overwritten PHP file via the web application triggers code execution.

php

//Reading File
if (!empty($_GET['file'])) {
-   preg_match('/.*\.(.*)$/', $_GET['file'], $preg_matches);
+   preg_match('/.*\.(html|css)$/', $_GET['file'], $preg_matches);
    if (empty($preg_matches)) {
        e(lang('remote_play_invalid_extension'));
    } else {

Source: ClipBucket Patch Commit f31de49

The patch replaces the permissive extension capture with an explicit allow-list of html and css, blocking selection of PHP files through this interface.

Detection Methods for CVE-2026-100372

Indicators of Compromise

HTTP requests to admin_area/template_editor.php containing ../ sequences in the folder or file parameters.
Modifications to PHP files outside the styles/ or layout template directories with recent timestamps matching administrator session activity.
Unexpected PHP files or webshells created under the ClipBucket web root following template editor access.
Outbound connections from the PHP-FPM or Apache process to attacker-controlled infrastructure.

Detection Strategies

Review web server access logs for GET and POST requests to template_editor.php that include encoded or literal traversal patterns (..%2F, ../).
Monitor file integrity on PHP files within the ClipBucket installation and alert on writes performed by the web server user.
Correlate administrator authentication events with filesystem write activity in non-template directories.

Monitoring Recommendations

Enable PHP audit logging to capture file_put_contents and fwrite operations originating from template_editor.php.
Alert on new or modified PHP files under the web root during periods outside planned maintenance.
Track creation of administrator accounts holding manage_template_access and review usage patterns.

How to Mitigate CVE-2026-100372

Immediate Actions Required

Upgrade ClipBucket v5 to release 5.5.3-#197 or later, available on the ClipBucket Releases page.
Audit all administrator accounts and revoke manage_template_access from users who do not require template editing.
Review the web root for unauthorized PHP file modifications since the installation was first exposed.

Patch Information

The vendor fix is published in commit f31de49b. The patch enforces an extension allow-list of html and css in the file selection logic within upload/admin_area/template_editor.php. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict access to /admin_area/template_editor.php at the web server level using IP allow-listing or an authenticated reverse proxy.
Set filesystem permissions so the web server user cannot write to PHP source files outside the template directory.
Temporarily disable the template editor by removing or renaming template_editor.php until patching is complete.

bash

# Example Apache configuration to restrict template_editor.php access
<Location "/admin_area/template_editor.php">
    Require ip 10.0.0.0/24
</Location>

# Tighten write permissions on PHP source files
find /var/www/clipbucket -name "*.php" -exec chmod 0444 {} \;
chown -R root:www-data /var/www/clipbucket