File Upload Vulnerability in ClipBucket by MacWarrior

CVE-2026-77929

What is CVE-2026-77929?

ClipBucket versions prior to 5.5.3-#182 are susceptible to a security flaw that permits authenticated users to upload malicious PHP files through the photo upload endpoint. The vulnerability arises because the FileUpload::manageFile() function in the fileupload.class.php file does not adequately sanitize the file extension post-MIME validation. As a result, an attacker can upload a file with valid image magic bytes, which retains a .php extension, enabling execution via PHP-FPM upon accessing the uploaded file.

References