The flaw resides in the remote play feature of ClipBucket v5, where users can create video entries that reference external video URLs without uploading the video files to the server. By providing a URL that points to an internal network host, the server triggers an SSRF, sending GET requests to internal services. This issue appears in all releases prior to 5.5.3, including earlier sub‑releases such as 5.5.2.#45.

Affected systems are deployments of the ClipBucket v5 open‑source video sharing platform from MacWarrior, specifically every release before 5.5.3. The listed product is clipbucket‑v5, and the vulnerability applies to all code versions before the 5.5.3 patch.

The risk is moderate, with a CVSS 3.1 score of 5.0, but the EPSS probability is below 1 %, indicating a low likelihood of exploitation. The flaw is exploitable by any user who can access the remote play page, allowing internal network enumeration but not direct code execution. Because the vulnerability is not in the CISA KEV catalog and no public exploit is known, the most effective defense is to apply the 5.5.3 upgrade or otherwise block internal destination addresses.