CVE-2025-21623·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 1.1% — higher than 61% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

ClipBucket V5 versions prior to 5.5.1-238 are vulnerable to unauthenticated directory traversal attacks that allow attackers to redirect the template directory, causing denial of service. Upgrade PHP and ClipBucket to version 5.5.1-238 or later to patch this vulnerability. If you are running ClipBucket V5 in your PHP environment, ensure your deployment is updated immediately.

sudo dnf update php php-common php-cli php-fpm -y

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET.*template.*\.\.\/|directory.*traversal.*template|template_dir=.*\/\.\.\/$

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block HTTP requests containing directory traversal patterns in the 'template' or 'template_dir' parameters. Use ModSecurity rule: SecRule ARGS:template|ARGS:template_dir "@rx (?:\.\./|\.\.\\|%2e%2e[/\\])" "id:1001,phase:2,deny,status:403,msg:'ClipBucket Template Directory Traversal Attempt'"

How to check if you are affected

1. Run 'php -v' to check the installed PHP version and verify ClipBucket version via admin panel or database query: SELECT value FROM clipbucket_settings WHERE name='version'
2. Check if ClipBucket V5 is installed by looking for the clipbucket directory in your web root (typically /var/www/html or /home/*/public_html)
3. Search web server logs for suspicious template directory parameter changes: grep -r 'template' /var/log/apache2/access.log | grep -i traversal
4. Verify the patch was applied by confirming ClipBucket version is 5.5.1-238 or later in the admin settings or by checking: php -r 'include "includes/config.php"; echo CLIPBUCKET_VERSION;'

Indicators of compromise

• POST parameter: template_dir with ../ sequence
• GET parameter: template containing path traversal sequences
• HTTP requests with Content-Type: application/x-www-form-urlencoded targeting template configuration endpoints

FAQ

Related PHP CVEs

References

• https://github.com/MacWarrior/clipbucket-v5/commit/75d663f010cd8569eb9e278f030838174fb30188
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-ffhj-hprx-7qvr