CVE-2025-55912

moderate-risk
Published 2025-09-18

An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler

Do I need to act?

~
4.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
52435
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.3/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Oxygenz

References (4)

Patch https://github.com/MacWarrior/clipbucket-v5/blob/5.5.0/upload/actions/photo_uplo...
Release Notes https://github.com/MacWarrior/clipbucket-v5/releases?page=2
Mitigation https://github.com/MacWarrior/clipbucket-v5/tree/5.5.0
Exploit https://medium.com/@mukund.s1337/cve-2025-55912-clipbucket-5-5-0-unauthenticated...
38
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 7/34 · Low
Exposure 5/34 · Minimal