CVE-2013-10040 CRITICAL

CVE-2013-10040: ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCE

Vendor Clipbucket Llc
Product ClipBucket
Weakness CWE-434 · Unrestricted file upload
Published July 31, 2025
Last update May 15, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file via a predictable path and trigger remote code execution.

Key dates

02Disclosure timeline

July 31, 2025 CVE published
May 15, 2026 Record updated