A critical arbitrary file upload vulnerability in ClipBucket allows unauthenticated attackers to achieve remote code execution on affected systems.

This vulnerability is caused by missing access controls within the photo_uploader.php script, specifically targeting the plupload endpoint. It allows an unauthenticated attacker to bypass security checks and upload arbitrary files, which can subsequently be executed by the server.

The ability for an unauthenticated user to upload and execute arbitrary files poses a severe risk to organizational security, as it typically leads to full remote code execution. This can result in complete system compromise, data exfiltration, and the installation of persistent backdoors. Given the CVSS score of 7.3, this vulnerability represents a high-severity threat that requires immediate remediation to prevent unauthorized access and potential data breaches.

Immediate Action: Upgrade ClipBucket to the latest version available from the vendor, as this version contains the necessary access control patches for the photo_uploader.php endpoint.

Proactive Monitoring: Monitor web server access logs for suspicious requests directed at the /actions/photo_uploader.php path, specifically looking for POST requests containing file upload signatures.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the photo_uploader.php endpoint or restrict file uploads to verified administrative sessions only.

Public Exploit Available: Yes — a public exploit exists via ExploitDB.

Given the availability of public exploit material and the high-impact nature of arbitrary file uploads, this vulnerability should be prioritized for immediate remediation. Administrators must identify all instances of ClipBucket 5.5.0 or earlier within their environment and apply the latest vendor patches to neutralize the risk of remote code execution.