{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-21622 exists.","fix":"No fix has been published for CVE-2025-21622 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-21622 is a high-severity path traversal vulnerability in MacWarrior clipbucket-v5, published on 7 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-21622 and fix it if it is affected.\n\nWhat it is: CVE-2025-21622 is a high-severity path traversal vulnerability in MacWarrior clipbucket-v5, published on 7 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-21622 exists.\n\nAffected product: MacWarrior clipbucket-v5. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-21622/ (Markdown: https://insights.sbomify.com/CVE-2025-21622/index.md)","id":"CVE-2025-21622","markdown":"https://insights.sbomify.com/CVE-2025-21622/index.md","name":"CVE-2025-21622","record":{"aliases":["GHSA-5qpx-23rw-36gg"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"ClipBucket video hosting","requires_auth":"none","summary":"Attackers can delete arbitrary files on the server via path traversal in the avatar URL field during avatar deletion.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"clipbucket","vendor":"oxygenz"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url as a filepath within the avatars subdirectory. If the URL path exists within the avatars directory, ClipBucket will delete it. There is no check for path traversal sequences in the provided user input (stored in the DB as avatar_url) therefore the final $file variable could be tainted with path traversal sequences. This leads to file deletion outside of the intended scope of the avatars folder. This vulnerability is fixed in 5.5.1 - 237.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete","id":"CVE-2025-21622","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"path_traversal","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"ClipBucket V5 Unauthenticated Template Directory Update to Denial-of-Service","id":"CVE-2025-21623"},"packages":[],"prev":{"headline":"GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format","id":"CVE-2025-21621"},"products":["clipbucket-v5"],"published":"2025-01-07","related":[{"cvss_score":9.8,"headline":"ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments","id":"CVE-2026-21875","kev_date_added":null,"published":"2026-01-07"},{"cvss_score":9.8,"headline":"Hardcoded credentials in n/a","id":"CVE-2025-67418","kev_date_added":null,"published":"2025-12-22"},{"cvss_score":9.8,"headline":"ClipBucket V5 Playlist Cover File Upload to Remote Code Execution","id":"CVE-2025-21624","kev_date_added":null,"published":"2025-01-07"},{"cvss_score":9.8,"headline":"Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199","id":"CVE-2024-54135","kev_date_added":null,"published":"2024-12-06"},{"cvss_score":9.8,"headline":"Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below","id":"CVE-2024-54136","kev_date_added":null,"published":"2024-12-06"},{"cvss_score":9.3,"headline":"ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition","id":"CVE-2026-25728","kev_date_added":null,"published":"2026-02-10"},{"cvss_score":8.8,"headline":"ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration","id":"CVE-2026-32321","kev_date_added":null,"published":"2026-03-18"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-01-07","vendors":["MacWarrior"]},"summary":"Attackers can delete arbitrary files on the server via path traversal in the avatar URL field during avatar deletion.","url":"https://insights.sbomify.com/CVE-2025-21622/"}