Technical impact
Path traversal in ClipBucket's admin template editor allows authenticated administrators to supply the folder parameter with traversal sequences, enabling them to overwrite PHP files outside the layout directory. This flaw, identified as CWE‑22, can lead to remote code execution by modifying executable server files, giving attackers the privileges of the web server user. The vulnerability exists only for versions of ClipBucket v5 before 5.5.3‑#197 and requires the user to have manage_template_access privilege. The impact is a complete loss of confidentiality, integrity and availability for the application and potentially the underlying server.
Affected Systems
The affected product is ClipBucket v5 from the MacWarrior vendor. All installations running any version prior to 5.5.3‑#197 are vulnerable. The path traversal can be triggered through the template_editor.php file within the admin area. Users who have administrator access with manage_template_access permission are impacted.
Risk and Exploitability
The CVSS score of 8.6 categorizes this as high severity. The EPSS score of 1% indicates a low but non-zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and possess the appropriate template editing rights to exploit the flaw. Once the vulnerability is leveraged, an attacker can change PHP files to execute arbitrary code on the web server, lending itself to a full remote code execution scenario.
