CVE-2026-26005— ClipBucket 代码问题漏洞

ClipBucket v5 enables internal network scans via an SSRF vulnerability

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SSRF can be triggered, causing GET requests to be sent to internal servers. An attacker can exploit this to scan the internal network. Even a regular (non-privileged) user can carry out the attack.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

服务端请求伪造(SSRF)

ClipBucket 代码问题漏洞

ClipBucket是MacWarrior开源的一个开源且可免费下载的 PHP 脚本。用于共享视频网站。 ClipBucket v5 5.5.3之前版本存在代码问题漏洞，该漏洞源于远程播放功能允许创建引用外部视频URL的视频条目，通过指定内部网络主机可能触发SSRF，导致向内部服务器发送GET请求。

N/A

N/A