CVE-2026-80138: ClipBucket V5 Web Installer RCE Vulnerability

CVE-2026-80138 Overview

CVE-2026-80138 is an operating system command injection vulnerability [CWE-78] in ClipBucket V5's web installer. The installer fails to validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can send a crafted POST request to the installer endpoint with a malicious php_cli_filepath value, resulting in arbitrary command execution as the web server user. The flaw affects ClipBucket V5 versions 5.5.1 through 5.5.3-#153 and was patched in revision 176.

Critical Impact
Unauthenticated remote attackers can execute arbitrary operating system commands as the web server user, leading to full application compromise and potential lateral movement.

Affected Products

ClipBucket V5 version 5.5.1
ClipBucket V5 versions 5.5.2 through 5.5.3-#153
ClipBucket V5 installer component (upload/cb_install/functions_install.php, upload/includes/classes/system.class.php)

Discovery Timeline

2026-08-25 - CVE-2026-80138 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80138

Vulnerability Analysis

The vulnerability resides in ClipBucket V5's installation workflow. During installation, the application accepts a user-supplied path to the PHP command line interface (CLI) binary via the php_cli_filepath POST parameter. That value is later concatenated into a shell command string and passed to PHP's exec() function without sanitization or path validation.

Because the installer is reachable before authentication is fully configured, an attacker does not need credentials to interact with it. Submitting shell metacharacters within the parameter causes the appended payload to execute in the same shell context as the web server process. Successful exploitation yields code execution as the web server user (typically www-data, apache, or nginx), which is sufficient to read application secrets, alter database contents, and drop persistent web shells.

Root Cause

The root cause is missing input validation on the php_cli_filepath parameter in the installer's binary-resolution routine. The code path in system.class.php used the attacker-controlled value directly rather than resolving it against a known binary location, checking file existence, and verifying executability.

Attack Vector

The vulnerability is exploitable over the network with no authentication and no user interaction. An attacker sends a single crafted POST request to the exposed installer route with a php_cli_filepath value containing shell command separators (for example, ;, |, or backticks) followed by the intended command.

php

// Patch excerpt from upload/includes/classes/system.class.php
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/36e7c6cfd81f62a091d2aeef96a8fc2fc2d85dc4
            $php_path = self::get_binaries('php', false);
        }

+        $php_path = realpath($php_path);
+        if (!$php_path || !is_file($php_path) || !is_executable($php_path)) {
+            return ['err' => 'Unable to find PHP CLI'];
+        }
        if( !self::check_php_function('exec', 'web', false) ){
            return [];
        }

The fix canonicalizes the supplied path using realpath() and rejects it unless it points to an existing, executable file, preventing shell metacharacters and non-binary payloads from reaching exec().

Detection Methods for CVE-2026-80138

Indicators of Compromise

POST requests to ClipBucket installer endpoints under /cb_install/ containing a php_cli_filepath parameter with shell metacharacters such as ;, |, &, $(, or backticks.
Web server processes (www-data, apache, nginx) spawning shell utilities such as sh, bash, curl, wget, nc, or python shortly after installer traffic.
Unexpected files written under the ClipBucket upload/ directory tree, particularly PHP files with random names or recent modification timestamps.

Detection Strategies

Alert on HTTP access log entries reaching /cb_install/ on production hosts, since the installer should not be reachable after deployment.
Inspect POST bodies to the installer for php_cli_filepath values containing characters outside the set expected in a filesystem path.
Correlate web server child-process creation events with inbound installer requests to identify command injection attempts.

Monitoring Recommendations

Enable process auditing on ClipBucket hosts and monitor for shell processes whose parent is the PHP-FPM or Apache worker.
Forward web server access logs and Linux auditd process-execution events to a centralized SIEM for correlation.
Track outbound network connections initiated by the web server user to detect reverse shells or second-stage payload retrieval.

How to Mitigate CVE-2026-80138

Immediate Actions Required

Upgrade ClipBucket V5 to revision 176 or later, which contains commit 36e7c6c fixing the php_cli_filepath validation.
Remove or block network access to the /cb_install/ directory on all production deployments.
Review web server logs for prior POST requests to the installer containing shell metacharacters and investigate hosts that match.

Patch Information

The vendor released the fix in commit 36e7c6c, bumping the ClipBucket V5 changelog from revision 175 to 176. The patch adds realpath() canonicalization and is_file() / is_executable() checks in upload/includes/classes/system.class.php before invoking exec(). Additional context is available in the VulnCheck advisory for ClipBucket.

Workarounds

Delete the upload/cb_install/ directory from any ClipBucket installation that has completed setup.
Restrict access to the installer path with a web server access control list limiting requests to trusted management IP addresses.
Deploy a web application firewall (WAF) rule to block POST requests containing shell metacharacters in the php_cli_filepath parameter.

bash

# Apache example: block access to the installer directory after deployment
<Location "/cb_install/">
    Require all denied
</Location>

# Nginx equivalent
location ^~ /cb_install/ {
    deny all;
    return 403;
}