CVE-2026-100372: Macwarrior Clipbucket-v5

High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days.

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user.

Affected products

• Macwarrior Clipbucket-v5

Published 2026-09-25. Last modified 2026-09-30.