CVE-2025-62424 ClipBucket path traversal vulnerability in template editor allows arbitrary file read and write

Medium 6.7 Published 17 Oct 2025 Updated 17 Oct 2025

Authenticated administrators can read and write arbitrary files via path traversal in the template editor, leading to information disclosure and potential server compromise.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-62424?

CVE-2025-62424 is a medium-severity path traversal vulnerability in MacWarrior clipbucket-v5, published on 17 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - #146 and earlier, the /admin_area/template_editor.php endpoint is vulnerable to path traversal. The validation of the file-loading path is inadequate, allowing authenticated administrators to read and write arbitrary files outside the intended template directory by inserting path traversal sequences into the folder parameter. An attacker with administrator privileges can exploit this vulnerability to read sensitive files such as /etc/passwd and modify writable files on the system, potentially leading to sensitive information disclosure and compromise of the application or server. This issue is fixed in version 5.5.2 - #147.

Weakness: CWE-22

Which versions are affected by CVE-2025-62424?

It affects 1 product.

Products include Oxygenz Clipbucket.

How do I fix CVE-2025-62424?

No fix has been published for CVE-2025-62424 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-62424 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62424 exists.

Sources

Also known as GHSA-3v2p-rfwx-52qj.