CVE-2025-21622 ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete

High 7.5 Published 7 Jan 2025 Updated 7 Jan 2025

Attackers can delete arbitrary files on the server via path traversal in the avatar URL field during avatar deletion.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-21622?

CVE-2025-21622 is a high-severity path traversal vulnerability in MacWarrior clipbucket-v5, published on 7 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url as a filepath within the avatars subdirectory. If the URL path exists within the avatars directory, ClipBucket will delete it. There is no check for path traversal sequences in the provided user input (stored in the DB as avatar_url) therefore the final $file variable could be tainted with path traversal sequences. This leads to file deletion outside of the intended scope of the avatars folder. This vulnerability is fixed in 5.5.1 - 237.

Weakness: CWE-22

Which versions are affected by CVE-2025-21622?

It affects 1 product.

Products include Oxygenz Clipbucket.

How do I fix CVE-2025-21622?

No fix has been published for CVE-2025-21622 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-21622 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-21622 exists.

Sources

Also known as GHSA-5qpx-23rw-36gg.