NPM · AUGUST 2026 · EARLY WARNING

Critical Vulnerability in ClipBucket V5 Web Installer: CVE-2026-80138

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.8
Affected component
clipbucket v5 (npm)
Affected versions
>= 5.5.3-#153, <= 5.5.3-#153 or >= 5.5.3-#149, <= 5.5.3-#149 or >= 5.5.3-#145, <= 5.5.3-#145 or >= 5.5.3-#136, <= 5.5.3-#136 or >= 5.5.3-#104, <= 5.5.3-#104 or >= 5.5.3-#93, <= 5.5.3-#93 or >= 5.5.3-#61, <= 5.5.3-#61 or >= 5.5.3-#50, <= 5.5.3-#50 or >= 5.5.3-#46, <= 5.5.3-#46 or >= 5.5.3-#10, <= 5.5.3-#10 or >= 5.5.2, <= 5.5.2 or >= 5.5.2-#187, <= 5.5.2-#187 or >= 5.5.2-#182, <= 5.5.2-#182 or >= 5.5.2-#164, <= 5.5.2-#164 or >= 5.5.2-#163, <= 5.5.2-#163 or >= 5.5.2-#162, <= 5.5.2-#162 or >= 5.5.2-#152, <= 5.5.2-#152 or >= 5.5.2-#147, <= 5.5.2-#147 or >= 5.5.2-#140, <= 5.5.2-#140 or >= 5.5.2-#138, <= 5.5.2-#138 or >= 5.5.2-#135, <= 5.5.2-#135 or >= 5.5.2-#133, <= 5.5.2-#133 or >= 5.5.2-#129, <= 5.5.2-#129 or >= 5.5.2-#123, <= 5.5.2-#123 or >= 5.5.2-#120, <= 5.5.2-#120 or >= 5.5.2-#117, <= 5.5.2-#117 or >= 5.5.2-#114, <= 5.5.2-#114 or >= 5.5.2-#106, <= 5.5.2-#106 or >= 5.5.2-#103, <= 5.5.2-#103 or >= 5.5.2-#98, <= 5.5.2-#98 or >= 5.5.2-#90, <= 5.5.2-#90 or >= 5.5.2-#86, <= 5.5.2-#86 or >= 5.5.2-#82, <= 5.5.2-#82 or >= 5.5.2-#74, <= 5.5.2-#74 or >= 5.5.2-#69, <= 5.5.2-#69 or >= 5.5.2-#58, <= 5.5.2-#58 or >= 5.5.2-#45, <= 5.5.2-#45 or >= 5.5.2-#38, <= 5.5.2-#38 or >= 5.5.2-#25, <= 5.5.2-#25 or >= 5.5.2-#4, <= 5.5.2-#4 or >= 5.5.1, <= 5.5.1
Patched version
Not yet available
CVE-2026-80138

An early warning has been issued for a critical vulnerability in ClipBucket V5's web installer. The vulnerability allows unauthenticated attackers to execute arbitrary commands as the web server user.

What happened

The vulnerability, tracked as CVE-2026-80138, is due to improper validation and escaping of the php_cli_filepath parameter before it is passed to shell execution. Attackers can exploit this by submitting a crafted POST request to the installer with a malicious php_cli_filepath value.

The affected versions of ClipBucket V5 (npm) include all versions from 5.5.1 up to and including 5.5.3-#153. The vulnerability is reportedly not yet exploited in the wild, and no supply-chain attack has been confirmed.

The issue was first flagged on 2026-08-25T23:17:59.860000+00:00. The CVSS score is currently 9.8, indicating a critical severity level.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If clipbucket v5 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using ClipBucket V5 (npm) in versions from 5.5.1 up to and including 5.5.3-#153.

What should I do right now?

Await a patch from the maintainers and avoid using the web installer until a fix is released.

Is there an official fix available yet?

No official fix has been published yet. Monitor the sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats