Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-25 | 1 | Disclosure1 |
| 2026-09-02 | 1 | Patch1 |
| 2026-09-04 | 1 | Disclosure1 |
🔐 CVE-2026-80138 | CVSS 9.8 Critical Found and responsibly disclosed an unauthenticated RCE in ClipBucket V5 via OS command injection. Technical write-up 👇 https://qwesired.com/blog/cve-2026-80138/ #CyberSecurity #CVE #AppSec
Post summary
CVE-2026-80138 was disclosed as a critical unauthenticated RCE in ClipBucket V5 triggered by OS command injection, with a technical write‑up link providing further details.
🚨 CRITICAL: CVE-2026-80138 (CVSS 9.8) ClipBucket V5 web installer allows unauthenticated RCE via php_cli_filepath parameter. Attackers can execute arbitrary commands remotely. Patch immediately if using ClipBucket V5. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/vjCXYSpdgJ
Post summary
The message highlights a critical CVE-2026-80138 in ClipBucket V5 that permits unauthenticated remote code execution through the php_cli_filepath parameter, and urges users to apply the patch immediately.
CVE-2026-80138 Arbitrary Command Execution in ClipBucket V5 Installer via php_cli_filepath https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-80138
Post summary
The text is a brief disclosure of CVE-2026-80138, highlighting an arbitrary command execution flaw in ClipBucket V5 via php_cli_filepath, without additional PoC, exploit, or mitigation information.