CVE-2026-77929: ClipBucket v5 File Upload RCE Vulnerability

CVE-2026-77929 Overview

CVE-2026-77929 is an unrestricted file upload vulnerability [CWE-434] in ClipBucket v5 versions prior to 5.5.3-#182. Authenticated users can achieve remote code execution by uploading a PHP file that carries valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function in fileupload.class.php validates MIME type but fails to update the file extension after validation. As a result, an attacker-controlled .php extension persists on disk and executes through PHP-FPM when the file is later retrieved.

Critical Impact
An authenticated attacker can execute arbitrary PHP code on the server, leading to full compromise of the ClipBucket host and its data.

Affected Products

ClipBucket v5 versions before 5.5.3-#182
Deployments serving uploaded files through PHP-FPM
Installations exposing the photo upload endpoint to authenticated users

Discovery Timeline

2026-09-18 - CVE-2026-77929 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77929

Vulnerability Analysis

The vulnerability resides in the ClipBucket photo upload workflow. The FileUpload::manageFile() routine inspects the uploaded file's MIME type using its magic bytes to confirm it is an image. However, the function does not rewrite or normalize the file extension after this check succeeds. An attacker can craft a polyglot payload that starts with valid image magic bytes (for example, a GIF or JPEG header) followed by PHP code, and name the file with a .php extension. ClipBucket writes the file to the files/ directory using the attacker-supplied name. When the file is requested over HTTP, the web server hands it to PHP-FPM for interpretation, executing the embedded code.

Root Cause

The root cause is a mismatch between content validation and extension enforcement. MIME validation confirms the file's byte signature but does not force a safe extension such as .jpg or .png. The upload path also lacks server-level restrictions preventing PHP execution within the uploads directory. Both gaps must be present for exploitation to succeed.

Attack Vector

Exploitation requires low-privilege authenticated access to the ClipBucket instance. The attacker submits a POST request to the photo upload endpoint containing a polyglot file with image magic bytes and a .php extension. After upload completes, the attacker requests the stored file's URL to trigger PHP execution and gain code execution in the context of the PHP-FPM worker.

No verified public exploit code is available. The vendor patch in commit 61cce55ab26ef88fb782dfde47b44c17c56978cd illustrates the fix by blocking PHP execution inside the uploads directory:

text

RewriteRule ^(.*/)\.(git|github|idea|gitignore|htaccess)$ $1/403 [NC,R=302,L]
RewriteRule ^(.*/)?(includes|changelog)/.*$ $1/403 [NC,R=302,L]
RewriteRule ^(.*/)?files/temp/.*$ $1/403 [NC,R=302,L]
RewriteRule ^(.*/)?files/.*\.php(?:/|$) $1/403 [NC,R=302,L]

# Direct access to files
RewriteCond %{REQUEST_URI} ^(.*/)?/files/ [NC]

Source: ClipBucket v5 patch commit 61cce55

Detection Methods for CVE-2026-77929

Indicators of Compromise

Files with .php or double extensions (.jpg.php, .png.php) inside the ClipBucket files/ and files/photos/ directories.
Web access log entries showing HTTP 200 responses to .php requests under /files/.
PHP-FPM process spawning shells, curl, wget, or writing files to /tmp shortly after a photo upload request.
Outbound network connections initiated by the web server user immediately following an upload event.

Detection Strategies

Inspect the files/ directory recursively for any file whose extension does not match its detected MIME type.
Correlate authenticated upload requests to photo endpoints with subsequent GET requests to newly written files in the same directory.
Alert on any PHP interpreter invocation for paths beneath the ClipBucket uploads tree.

Monitoring Recommendations

Enable web server and PHP-FPM access logging with full URI capture and retain logs long enough for retrospective hunting.
Monitor process ancestry from the PHP-FPM master for unexpected child processes such as /bin/sh, bash, or python.
Track file creation events in the uploads directory using file integrity monitoring or auditd rules.

How to Mitigate CVE-2026-77929

Immediate Actions Required

Upgrade ClipBucket v5 to release 5.5.3-#182 or later, which ships the vendor patch.
Audit the files/ directory for existing .php files and remove any that were not placed by administrators.
Rotate any credentials, API keys, or database secrets stored on the ClipBucket host if unauthorized .php files are found.

Patch Information

The fix is delivered in commit 61cce55ab26ef88fb782dfde47b44c17c56978cd and included in the ClipBucket v5.5.3-#182 release. The patch adds .htaccess rules that return HTTP 403 for any .php request under the files/ path, preventing PHP-FPM from interpreting uploaded content. Additional details are available in the VulnCheck advisory.

Workarounds

Deploy the .htaccess rule from the patch to block PHP execution beneath the uploads directory on Apache installations.
On nginx, add a location ~ ^/files/.*\.php$ { return 403; } directive to the vhost configuration and reload the service.
Restrict access to the photo upload endpoint to trusted user roles only until the patched release is deployed.
Configure PHP-FPM to refuse execution of files outside the application's expected script directories.

bash

# nginx workaround: deny PHP execution inside ClipBucket uploads
location ~ ^/files/.*\.php(?:/|$) {
    return 403;
}

# Verify no rogue PHP files exist in the uploads tree
find /var/www/clipbucket/upload/files -type f -iname '*.php' -print