CVE-2025-21622 is a high severity path traversal flaw (CVSS 7.5) in ClipBucket V5, the open source PHP video hosting software. The avatar deletion step does not check the stored path, so files outside the avatars folder can be deleted. The fix is in 5.5.1 build 237.
What's affected
- Product: ClipBucket V5 (OxygenZ), open source video hosting written in PHP
- Affected versions: releases before 5.5.1 build 237
- Fixed version: 5.5.1 build 237, as written in the record
- Vulnerable area: user avatar upload and deletion
- CVSS: 7.5 (High), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published: 2025-01-07
The vector shows no privileges and no user interaction, with the impact limited to availability, which fits a delete only flaw. The project's advisory links a fix commit. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.
How to check if you're exposed
Find the ClipBucket version in the admin area, or in the version file in the project root.
# look for the version information in the installed tree
grep -rn "VERSION" /var/www/clipbucket --include=*.php | head
Compare the result with 5.5.1 build 237. The project uses a build number after the version, so a version that reads 5.5.1 with a lower build is still affected. A free in-browser dependency scan on the project's Composer files will cover the libraries around it.
Then see whether the site allows public registration. The delete step is reached through the avatar workflow that any user can use, so open sign up widens exposure. Check that the web server user can only write where it needs to, because that sets the limit of what a bad delete can reach.
What to do now
- Upgrade ClipBucket V5 to 5.5.1 build 237 or later, after a full backup of files and database.
- Run PHP and the web server as a user that can write only to upload, cache and log folders, so a delete cannot reach code or config.
- Check for missing files in the web root and configuration folders, and restore from backup if anything is gone.
- Review recent avatar changes for odd stored paths in the user table if you have database access.
- Keep an eye on the project's releases, since it ships fixes often.
Why it matters
The weakness is CWE-22, path traversal. The software stores the avatar location as text and later deletes whatever file that text points to, but only checks that the path appears to be within the avatars folder. Sequences that climb out of the folder survive that check, so the delete lands on a file somewhere else.
The impact is on availability and integrity of the site rather than secrecy. A deleted configuration file or a missing lock file can take a site down or reset its setup flow, and on some installs deleting the right file opens another door. The simple defence in the code is to resolve the full path and confirm it still sits inside the intended folder before acting on it.
Quick check
Which version fixes it?
ClipBucket V5 5.5.1 build 237, as stated in the record and the project's advisory.
Can it leak data?
The vector rates confidentiality and integrity impact as none, and availability as high. It is a deletion flaw.
Sources
Last reviewed: 19 October 2026.
