CVE-2013-10040

CRITICAL EPSS 83.4%
Published Jul 31, 202511mo ago · Modified Jun 16, 20262w ago
10.0 CVSS 4.0
Critical
Find Similar
Published Jul 31, 2025 11mo ago
Last Modified Jun 16, 2026 2w ago

Description

ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file via a predictable path and trigger remote code execution.

CVSS Details

Base Score
10.0
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
83.4% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 1

VendorProductVersionRange
clip-bucketclipbucket* ≤2.6

References 5

  • clipbucket.com https://clipbucket.com/
    Product
  • github.com https://github.com/arslancb/clipbucket
    Product
  • packetstorm.news https://packetstorm.news/files/id/123480
    ExploitThird Party Advisory
  • raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/clipbucket_upload_exec.rb
    ExploitThird Party Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/clipbucket-arbitrary-file-upload-rce
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.