CVE-2026-80138 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

A critical remote‑code‑execution flaw (CVE‑2026‑80138) in ClipBucket V5’s web installer permits unauthenticated attackers to run arbitrary commands as the web‑server user. All organizations that host ClipBucket V5 instances are exposed to immediate compromise of their web servers and any data they process. Leadership must authorize emergency patch or temporary installer disablement and activate an incident‑response workflow within the next 24 hours.

Verified Facts

• ClipBucket V5’s web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution — article.
• Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web‑server user — article.
• CVSS 3.1 base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — article.
• The vulnerability is classified as CWE‑78 (Improper Neutralization of Special Elements used in an OS Command) — article.

Threat Classification

Threat type: unauthenticated remote‑code execution via command injection (HIGH CONFIDENCE). Affected sectors: any sector deploying ClipBucket V5 for video hosting, including media, education, NGOs, and corporate intranets (MEDIUM CONFIDENCE). Geographic scope: global distribution of the open‑source package (MEDIUM CONFIDENCE). Exploitation status: publicly disclosed proof‑of‑concept exists, but no evidence of active exploitation in the wild (MEDIUM CONFIDENCE). Attacker motivation: acquisition of server control to host malicious content or exfiltrate data (LOW CONFIDENCE).

Threat Severity Assessment

• Exploitability – unauthenticated network access, low‑complexity POST request (HIGH CONFIDENCE).
• Impact – full confidentiality, integrity, and availability compromise (HIGH CONFIDENCE).
• CVSS score – 9.8 (Critical) (HIGH CONFIDENCE).
• Prevalence – ClipBucket V5 is widely downloaded from public repositories (MEDIUM CONFIDENCE).

Business Impact

• Operational disruption: successful exploitation yields a web‑server shell, enabling service outage, defacement, or lateral movement into internal assets.
• Regulatory liability: if the compromised server processes personal data, GDPR exposure may trigger fines up to €20 million or 4 % of annual turnover; NIS2‑covered operators could face sector‑specific penalties.
• Financial exposure: incident‑response, forensic analysis, and system hardening costs typically range from $150 k to $500 k for medium‑size enterprises.
• Reputational damage: public disclosure of a compromised video‑hosting platform can erode user trust and lead to churn of content creators.

Technical Analysis

• Attack vector: Network‑level unauthenticated HTTP POST to the ClipBucket installer endpoint.
• Exploitation chain: attacker supplies a malicious php_cli_filepath value → the value is concatenated into a shell command without sanitization → operating‑system command execution occurs under the web‑server user account.
• Affected component: ClipBucket V5 web installer script handling the php_cli_filepath parameter.
• Root cause: Command injection (CWE‑78) caused by missing input validation/escaping before invoking the shell.
• Versions impacted: All releases identified as ClipBucket V5 (exact sub‑versions not disclosed).

CVE Analysis

• CVE‑2026‑80138 – ClipBucket V5 web installer – CWE‑78 (Command Injection) – Network‑borne, unauthenticated – No public patch released at time of article.

MITRE ATT&CK Mapping

• Execution → T1059.004: Unix Shell – the attacker injects a malicious command line into a PHP‑driven shell execution path.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral hunting guidance (minimum four indicators):

• HTTP POST requests to any ClipBucket installer endpoint containing the parameter name php_cli_filepath.
• POST payloads where php_cli_filepath includes shell metacharacters such as ;, &&, |, or backticks.
• Process creation events where a php or php‑cgi binary spawns a child process of sh/bash with a command line that mirrors the supplied php_cli_filepath value.
• New executable or script files written to the web‑root directory shortly after a POST to the installer (e.g., files with .php, .sh extensions appearing in /var/www/html/).
• Outbound network connections from the web‑server user to previously unseen IP addresses within 5 minutes of a suspicious installer request.

Detection Engineering Guidance

• Web‑server access logs (Apache access_log or Nginx access.log): filter for POST requests to /install.php (or any installer script) where the query string or request body contains php_cli_filepath and any of the characters ;, &&, |, `. Flag as high severity.
• Application logs (ClipBucket error or debug logs): monitor for entries indicating execution of external commands or failures in the installer module.
• Sysmon Event ID 1 (Process Create) on Windows hosts or Linux auditd EXECVE records: detect a parent php process spawning a shell with a command line that includes the attacker‑supplied path value.
• File integrity monitoring (FIM) on the web‑root: alert on creation of new executable files (e.g., *.php, *.sh) within 2 minutes of a flagged installer request.
• Outbound DNS or netflow records: flag connections from the web‑server user to external IPs that have no prior baseline traffic.

Sigma Rules

title: ClipBucket Installer Command Injection Attempt
id: 3b9f2c1e-7a4d-4f9b-9c2e-1a6d5f8e9b3a
status: stable
description: Detects HTTP POST requests to ClipBucket installer scripts containing a php_cli_filepath parameter with shell metacharacters.
logsource:
    product: webserver
    service: apache
detection:
    selection:
        http_method: POST
        url|contains:
            - install.php
            - installer.php
        request_body|regex: '(?i)php_cli_filepath=.*[;|&]{1,}'
    condition: selection
falsepositives:
    - Legitimate administrative uploads using the installer (rare)
level: high
tags:
    - attack.execution
    - attack.t1059.004

title: PHP Process Spawning Shell with Untrusted Argument
id: d7a4e9c2-5b1f-4c3a-8e6d-2f9b7c1a0e4d
status: stable
description: Detects a PHP process

🔗 Related Intelligence Reports

• Related topic: CVE-2026-79911 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-80104 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-79787 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76193 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76195 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record