ClipBucket v5 allows an unauthenticated attacker to execute arbitrary OS commands by exploiting the installer script’s php_cli_filepath parameter. The vulnerability arises because the parameter is used directly in shell execution without validation or escaping, enabling code injection. This is a classic OS Command Injection flaw identified as CWE‑78. As a result, an attacker can gain the web server user’s privileges and run any command on the system, leading to full system compromise.

The flaw exists in MacWarrior’s ClipBucket v5 product, versions 5.5.1 through 5.5.3. These releases expose the installer at upload/cb_install/functions_install.php and the vulnerable system.class.php file. Users running any of these versions should verify their installation and check for updates from the project repository.

The CVSS score of 9.2 indicates a critical severity, and while the EPSS score is not available, the design of the vulnerability permits unauthenticated remote exploitation. The attacker can send a crafted POST request to the installer with a malicious php_cli_filepath value; no authentication or additional credentials are required. The vulnerability is not listed in the CISA KEV catalog, but the absence of interception points increases the likelihood of exploitation in a production environment.