NVD CRITICAL: CVE-2026-80138 — ClipBucket V5's web installer fails to properly validate or escape the php_cli_f...

Tuesday, August 25, 2026 at 11:17 PM UTC·Source: NIST NVD

Updated: Wednesday, August 26, 2026 at 12:01 AM UTC

Executive Summary

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-80138

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Aug 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Japan to form study group for blockchain-based settlement of stock and bonds

Japan's FSA, finance ministry and central bank are planning to develop a national blockchain-based settlement infrastructure for stocks and Japanese government bonds (JGBs), the Nikkei reported Wednesday.

22m agoFinextra

MEDIUMVulnerability

Standard Chartered becomes first G-SIB to issue digitally native notes on Euroclear’s D-FMI

Standard Chartered today announced the issuance of a USD 200 million three-year floating-rate digitally native notes (DNNs), becoming the first Global Systemically Important Bank (G-SIB) and the first UK Issuer to issue on Euroclear’s Digital Financial Market Infrastructure (D-FMI).

1h agoFinextra

MEDIUMVulnerability

Choose your fighter: Balancing competing requirements to select models for your AI SOC

Selecting a model for your security operations center (SOC) and digital forensics and incident response (DFIR) tasks is important, but selecting the best one is more involved than you might think. Here's how to choose.

1h agoCisco Talos