Critical Vulnerability in ClipBucket V5 Web Installer: CVE-2026-80138
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- clipbucket v5 (npm)
- Affected versions
- >= 5.5.3-#153, <= 5.5.3-#153 or >= 5.5.3-#149, <= 5.5.3-#149 or >= 5.5.3-#145, <= 5.5.3-#145 or >= 5.5.3-#136, <= 5.5.3-#136 or >= 5.5.3-#104, <= 5.5.3-#104 or >= 5.5.3-#93, <= 5.5.3-#93 or >= 5.5.3-#61, <= 5.5.3-#61 or >= 5.5.3-#50, <= 5.5.3-#50 or >= 5.5.3-#46, <= 5.5.3-#46 or >= 5.5.3-#10, <= 5.5.3-#10 or >= 5.5.2, <= 5.5.2 or >= 5.5.2-#187, <= 5.5.2-#187 or >= 5.5.2-#182, <= 5.5.2-#182 or >= 5.5.2-#164, <= 5.5.2-#164 or >= 5.5.2-#163, <= 5.5.2-#163 or >= 5.5.2-#162, <= 5.5.2-#162 or >= 5.5.2-#152, <= 5.5.2-#152 or >= 5.5.2-#147, <= 5.5.2-#147 or >= 5.5.2-#140, <= 5.5.2-#140 or >= 5.5.2-#138, <= 5.5.2-#138 or >= 5.5.2-#135, <= 5.5.2-#135 or >= 5.5.2-#133, <= 5.5.2-#133 or >= 5.5.2-#129, <= 5.5.2-#129 or >= 5.5.2-#123, <= 5.5.2-#123 or >= 5.5.2-#120, <= 5.5.2-#120 or >= 5.5.2-#117, <= 5.5.2-#117 or >= 5.5.2-#114, <= 5.5.2-#114 or >= 5.5.2-#106, <= 5.5.2-#106 or >= 5.5.2-#103, <= 5.5.2-#103 or >= 5.5.2-#98, <= 5.5.2-#98 or >= 5.5.2-#90, <= 5.5.2-#90 or >= 5.5.2-#86, <= 5.5.2-#86 or >= 5.5.2-#82, <= 5.5.2-#82 or >= 5.5.2-#74, <= 5.5.2-#74 or >= 5.5.2-#69, <= 5.5.2-#69 or >= 5.5.2-#58, <= 5.5.2-#58 or >= 5.5.2-#45, <= 5.5.2-#45 or >= 5.5.2-#38, <= 5.5.2-#38 or >= 5.5.2-#25, <= 5.5.2-#25 or >= 5.5.2-#4, <= 5.5.2-#4 or >= 5.5.1, <= 5.5.1
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in ClipBucket V5's web installer. The vulnerability allows unauthenticated attackers to execute arbitrary commands as the web server user.
What happened
The vulnerability, tracked as CVE-2026-80138, is due to improper validation and escaping of the php_cli_filepath parameter before it is passed to shell execution. Attackers can exploit this by submitting a crafted POST request to the installer with a malicious php_cli_filepath value.
The affected versions of ClipBucket V5 (npm) include all versions from 5.5.1 up to and including 5.5.3-#153. The vulnerability is reportedly not yet exploited in the wild, and no supply-chain attack has been confirmed.
The issue was first flagged on 2026-08-25T23:17:59.860000+00:00. The CVSS score is currently 9.8, indicating a critical severity level.
What to do about it
- Await a patch from the maintainers of ClipBucket V5.
- Avoid using the web installer until a fix is released.
- Monitor the primary sources for updates on the vulnerability and any available patches.
- Review your systems for any instances of ClipBucket V5 within the affected version ranges and take appropriate action to secure them.
How 0Day would have caught this
clipbucket v5 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using ClipBucket V5 (npm) in versions from 5.5.1 up to and including 5.5.3-#153.
What should I do right now?
Await a patch from the maintainers and avoid using the web installer until a fix is released.
Is there an official fix available yet?
No official fix has been published yet. Monitor the sources for updates.