CVE-2026-80138: Macwarrior Clipbucket-v5

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

Affected products

• Macwarrior Clipbucket-v5

Published 2026-08-25. Last modified 2026-09-24.