CVE-2025-64338 is a critical (CVSS 9.0) stored cross-site scripting flaw in ClipBucket v5, the open source video sharing platform. A regular user could plant script in a photo collection name that runs when an administrator opens Manage Photos. Build 5.5.2 number 157 fixes it.
What's affected
The NVD record says ClipBucket v5 versions 5.5.2 build 156 and below are affected, and the issue is fixed in 5.5.2 build 157. ClipBucket uses a build number after the version, so compare the number after the hash sign. The record references the fix commit and advisory GHSA-93rh-fxxx-j38j in the MacWarrior/clipbucket-v5 repository. We could not retrieve the advisory text.
The attack needs an authenticated account, which may be any regular user on a site that allows open registration. It also needs an administrator to open the affected page.
How to check if you're exposed
Find the version and build of your installation. If you deployed from git, check which commit you are on:
git -C /path/to/clipbucket-v5 log -1 --format='%H %cd'
Compare against the fix commit 8e3cf79ce2721fbebde68a05a9a1a6319f086bcc referenced in the record. The next command succeeds when your checkout includes the fix:
git -C /path/to/clipbucket-v5 merge-base --is-ancestor 8e3cf79ce2721fbebde68a05a9a1a6319f086bcc HEAD && echo "fix present"
Then look at your data. Review photo collection names in the database or admin panel for unusual markup, and note whether public registration is on. If it is, the set of possible attackers is large.
What to do now
- Update ClipBucket v5 to build 157 of 5.5.2 or later.
- Review existing photo collection names for odd characters or markup and clean any you find.
- If you can, limit new account registration until you have updated.
- Have administrators use a separate browser profile for the admin panel.
- Add a Content Security Policy at your web server if you do not have one, as a second layer.
Why it matters
The record lists CWE-79, cross-site scripting, and CWE-269, improper privilege management. The first names the bug: a collection name was shown in the admin interface without being made safe. The second reflects the effect. A user with ordinary rights gets code to run with the rights of an administrator.
Stored XSS in an admin page is a classic route from a low privilege account to a high privilege one. Output encoding in templates is the standard fix. The record does not list the CVE as known exploited.
Quick check
Does the attacker need to be an administrator?
No. A regular authenticated user can create the collection. The script runs when an administrator views the page.
How do I read the version number?
The fixed release is 5.5.2 build 157. Builds up to 156 are affected.
Sources
Last reviewed: 18 October 2026.
