Critical · published November 7, 2025
⚠️ An authenticated user can turn your admin panel into a playground for malicious scripts! With ClipBucket v5.5.2 - #156 and below, there's a sneaky Stored XSS vulnerability just waiting to be exploited. 🔥 Think of it like a guest sneaking in a dessert that looks harmless but is actually filled with nasty surprises. Just like how a poorly checked recipe could ruin the restaurant's reputation, this vulnerability lets attackers inject harmful scripts right into the admin interface! If an attacker gets creative, they could execute their scripts in the administrator's browser and perform actions with elevated privileges. This could lead to unauthorized access to sensitive data or even complete control over the admin account. That's a recipe for disaster!
Think of it like a guest sneaking in a dessert that looks harmless but is actually filled with nasty surprises. Just like how a poorly checked recipe could ruin the restaurant's reputation, this vulnerability lets attackers inject harmful scripts right into the admin interface! This vulnerability allows an authenticated regular user to create a photo collection with a name that contains HTML/JavaScript payloads. When an admin accesses the Manage Photos interface, those payloads are rendered unsafely, executing the attacker's code in the admin's browser.
If an attacker gets creative, they could execute their scripts in the administrator's browser and perform actions with elevated privileges. This could lead to unauthorized access to sensitive data or even complete control over the admin account. That's a recipe for disaster! Upgrade to ClipBucket version 5.5.2 - #157 immediately to patch this vulnerability. Additionally, consider implementing content security policies to further mitigate risks associated with user-generated content. Regularly audit your user permissions to minimize exposure! You've got this! Follow these steps, and you’ll secure your ClipBucket installation in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| oxygenz/clipbucket | ≥ 5.3, < 5.5.2-157 | 5.5.2-157 |