CVE-2026-100372 MacWarrior CVE debrief

Who should care

Administrators and security teams responsible for managing ClipBucket installations should assess exposure and prioritize verification and remediation efforts to prevent potential exploitation. This includes reviewing template editor access controls, monitoring for suspicious activity, and implementing additional security measures to prevent exploitation. Security teams should also track exceptions, retest remediated assets, and close the item only after

Why it matters

CVE-2026-100372 is a high-severity path traversal vulnerability in ClipBucket that allows authenticated administrators to overwrite PHP files, potentially leading to remote code execution. Administrators and security teams should prioritize verifying and updating ClipBucket installations to prevent potential exploitation.

• Potential remote code execution as the web server user
• Overwrite of PHP files by authenticated administrators
• Modification of executable files outside the layout directory

Technical summary

The vulnerability exists in the admin template editor of ClipBucket v5 before 5.5.3-#197. Authenticated administrators with manage_template_access permission can traverse outside the layout directory and modify executable PHP files by supplying directory traversal sequences in the folder parameter. This could lead to remote code execution as the web server user. The vulnerability has a CVSS score of 8.6 and is considered high-severity. Administrators and security teams should prioritize verifying and updating ClipBucket installations to prevent potential exploitation.

Defensive priority

Administrators and security teams should prioritize verifying and updating ClipBucket installations to prevent potential exploitation.

Recommended defensive actions

• Verify ClipBucket installations and update to version 5.5.3-#197 or later
• Restrict access to the template editor to prevent unauthorized modifications
• Monitor for suspicious activity and implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD entry. Various source references, including GitHub repositories and a VulnCheck advisory, provide additional details. However, the exact scope of affected deployments and specific exploitation attempts remain unclear. Defenders should verify ClipBucket installations, review template editor access controls, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.