CVE-2013-10040 is a critical (CVSS 9.8) unrestricted file upload in ClipBucket 2.6 and earlier. The ofc_upload_image.php script in the admin charts library accepts files from unauthenticated users, including executable PHP, which can then be requested at a predictable path. Upgrade, or remove the script.
What's affected
ClipBucket version 2.6 and earlier, per the record and VulnCheck. The vulnerable script is ofc_upload_image.php, located under admin_area/charts/ofc-library/.
I could not confirm a specific fixed version from the sources available. The project's pages and repository are the place to check. If your copy cannot be upgraded, removing the vulnerable script and blocking access to the charts library path are reasonable stopgaps, though an upgrade is the real fix.
The record says the upload is reachable without logging in and that the stored file can be requested at a predictable path.
How to check if you're exposed
Check your ClipBucket version in the admin area or the project's version file, and look for the vulnerable script:
find /var/www -path "*ofc-library*" -name "ofc_upload_image.php"
If the file exists on a 2.6 or earlier install, the endpoint is likely live. Then look in the upload and chart directories for PHP files that should not be there:
find /var/www/site -path "*ofc-library*" -name "*.php" -newer /var/www/site/index.php
Check web server logs for POST requests to the script from unfamiliar addresses.
If you have a web application firewall or reverse proxy, add a temporary rule that blocks requests to the script path while you upgrade.
What to do now
- Identify all ClipBucket installs and versions.
- Upgrade to a fixed release from the project. Check the repository for the current version.
- Remove ofc_upload_image.php and deny web access to the charts library path if you cannot upgrade right away.
- Inspect upload and chart folders for unexpected PHP files, and rebuild the site from clean sources if you find any.
- Configure the web server to refuse script execution in upload directories.
Why it matters
The weakness is CWE-434 (Unrestricted Upload of File with Dangerous Type). The script writes whatever a visitor sends into a folder that the web server serves and executes. No login is required, no file type is checked, and the stored path is predictable, so the three steps from upload to code execution all work for an outsider.
Charting libraries bundled into admin areas are a recurring source of this bug. The component was never meant to face the public, but nothing in front of it said so. Removing unused components, blocking script execution in upload folders and requiring authentication on every admin path are the usual defences.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild, though public exploit material is referenced.
Quick check
Is there a fixed ClipBucket version?
I could not confirm one from the available sources. Check the ClipBucket project for the current release and its notes.
What is a quick mitigation?
Remove the vulnerable script, block the charts library path, and stop script execution in upload folders. Then upgrade.
Sources
Last reviewed: 19 October 2026.
