One Code Review, Seven CVEs: What We Found in rConfig, ClipBucket and Snipe-IT

Seven vulnerabilities. Three open-source platforms. Several relatively small coding weaknesses that could lead to administrator access, sensitive file disclosure, SQL injection or remote code execution.

During manual source code reviews of rConfig Core, ClipBucket V5 and Snipe-IT, Adam Nurudini, Offensive Security Consultant within the Sekuro Offensive Security Team, identified seven previously undisclosed vulnerabilities across the three platforms. The findings were assigned CVEs with CVSS v4.0 base scores ranging from 7.1 High to 9.3 Critical.

The vulnerabilities included an unauthenticated administrator account takeover in rConfig Core, unauthenticated command injection in the ClipBucket installer, an authenticated image upload path to remote code execution, SQL injection vulnerabilities, and a Snipe-IT issue that could allow local file reads and server-side requests through crafted Markdown content.

The findings were responsibly disclosed to the respective maintainers. The affected vendors subsequently released fixes for all reported vulnerabilities.

This article looks at what was found, how the vulnerabilities worked, and what changed as a result.

At a Glance

What the Source Code Review Found

All seven findings were identified through manual source code review rather than automated vulnerability scanning.

The reviews focused on how user-controlled data moved through authentication, file handling, database queries, command execution and application logic. Several of the findings were caused by assumptions made by individual functions about the type or format of incoming data.

Both rConfig Core and Snipe-IT are built on Laravel. In Laravel applications, the .env file contains secrets such as the APP_KEY used for all cryptographic operations, database credentials, mail passwords and any configured API keys. Disclosure of that file has consequences well beyond a simple file read, because the exposed secrets can be used to decrypt stored credentials, forge user sessions and access connected services. This context is important when assessing the rConfig path traversal and the Snipe-IT file read findings later in this article.

The ClipBucket findings were particularly notable. Four of the seven vulnerabilities affected different parts of the application, including the installer, photo uploads, private messaging and photo deletion. Two of the SQL injection vulnerabilities shared a similar underlying pattern where an application sanitisation routine could be bypassed by supplying an array where a scalar value was expected.

CVE Summary

rConfig Core

rConfig V8 Core is a free, open-source, and self-hosted Network Configuration Management platform built on a modern PHP/Laravel architecture. It is used to automate multi-vendor configuration backups, track version history, and manage network device settings across routers, switches, and firewalls without licensing fees or device limits.

Two vulnerabilities were identified in rConfig Core. Together, they create a path from any authenticated session to full application and infrastructure compromise.

1. Unauthenticated Admin Takeover

CVE-2026-77915 | CVSS v4.0 9.3 Critical

The first rConfig finding involved the application’s registration routes.

A duplicate Auth::routes() call re-enabled the registration endpoint even though registration had been disabled. The registration process also did not explicitly assign a role to the newly created account. The users.role database column defaulted to Admin.

As a result, an unauthenticated attacker could submit a registration request and create an administrator account without first authenticating to the application.

The issue affected rConfig versions before 8.2.10.

The impact went beyond the creation of an unwanted account. An administrator account provides access to the application’s full administrative functionality, including stored credentials for managed network devices.

Read the full CVE-2026-77915 technical write-up.

2. Path Traversal to Sensitive File Disclosure

CVE-2026-77914 | CVSS v4.0 7.1 High

A file export endpoint in rConfig Core accepted a user-controlled filename parameter and used it to construct a filesystem path without sufficient path traversal protection.

An authenticated user, including a low-privilege account, could manipulate the filename to access files outside the intended export directory.

One particularly sensitive target was the application’s .env file. As noted earlier, this file can contain the Laravel APP_KEY, database credentials and other application secrets. Exposure of those secrets can significantly increase the impact of an otherwise straightforward arbitrary file read, because the APP_KEY can be used to decrypt stored device credentials and forge authenticated sessions.

The issue was addressed in rConfig 8.2.13.

Read the full CVE-2026-77914 technical write-up.

ClipBucket V5

ClipBucket V5 is a free, open-source video and photo sharing platform built in PHP. It is the successor to the original ClipBucket project, which is no longer actively maintained. Four vulnerabilities were identified across ClipBucket V5, affecting the installer, photo uploads, private messaging and photo management.

Four ClipBucket Findings, One Recurring Pattern

The four vulnerabilities occurred in different areas of the application, but the findings showed a recurring problem with how the application handled user-controlled input.

The two SQL injection vulnerabilities are a clear example. Both involved application logic that expected a scalar value but could be supplied with an array. That unexpected data type allowed the existing sanitisation logic to be bypassed before the value reached a SQL query.

The result was two separate blind SQL injection vulnerabilities in different parts of the application.

3. Unauthenticated RCE via Installer Command Injection

CVE-2026-80138 | CVSS v4.0 9.2 Critical

The ClipBucket V5 installer contained an operating system command injection vulnerability involving the php_cli_filepath parameter.

The parameter was passed into exec() without appropriate escaping, allowing attacker-controlled input to reach command execution. The affected installation flow could be reached without authentication. When the installer remained accessible, an attacker could submit a crafted request and execute commands on the server as the web application process. No database connection, active session or prior interaction was required.

The vulnerability affected ClipBucket V5 versions through 5.5.3-#153 and was addressed in subsequent releases.

Read the full CVE-2026-80138 technical write-up.

4. Image Upload to Remote Code Execution

CVE-2026-77929 | CVSS v4.0 8.7 High

ClipBucket V5 also contained a separate vulnerability in its photo upload functionality.

The upload handler performed MIME validation but did not prevent an uploaded file from retaining a .php extension. By supplying a PHP file containing valid image magic bytes, an authenticated attacker could pass the image validation check while retaining a file extension that allowed PHP execution.

The uploaded file was written to disk and could subsequently be processed by PHP-FPM when accessed. This created an authenticated path to remote code execution on the affected server.

The issue was addressed in ClipBucket 5.5.3-#182.

Read the full CVE-2026-77929 technical write-up.

5. Blind SQL Injection via Private Message Deletion

CVE-2026-77928 | CVSS v4.0 7.1 High

The first ClipBucket SQL injection vulnerability affected private message deletion.

The msg_id parameter was expected to contain a message identifier. However, supplying the parameter as an array allowed an attacker to bypass the application’s clean_requests() sanitisation logic. The resulting value was then incorporated into a SQL query without appropriate parameterisation.

An authenticated attacker could use the resulting SQL injection for time-based blind extraction of database information, including user email addresses and credential hashes.

The issue was addressed in ClipBucket 5.5.3-#182.

Read the full CVE-2026-77928 technical write-up.

6. Blind SQL Injection via Photo Deletion

CVE-2026-77927 | CVSS v4.0 7.1 High

A closely related vulnerability was found in ClipBucket’s bulk photo deletion functionality.

The check_photo parameter could be supplied as an array, bypassing the same sanitisation mechanism used elsewhere in the application. The resulting input could then reach a SQL query without appropriate parameterisation, allowing an authenticated attacker to perform time-based blind SQL injection and extract sensitive information from the database.

The issue was addressed in ClipBucket 5.5.3-#182.

Read the full CVE-2026-77927 technical write-up.

Snipe-IT

Snipe-IT is an open-source, web-based IT asset management system designed to track hardware, software licences, accessories and consumables in a centralised platform.

One vulnerability was identified in Snipe-IT, affecting the checkout acceptance workflow.

7. Arbitrary File Read and SSRF via Acceptance Note Injection

CVE-2026-86751 | CVSS v4.0 8.4 High

Snipe-IT contained a vulnerability in checkout acceptance notes that could be exploited through crafted Markdown content.

An attacker could place a Markdown image reference in an acceptance note. The content was subsequently processed into HTML, allowing the image source to be handled by the application’s mail processing functionality.

With the affected mail embedding behaviour enabled, the application could attempt to retrieve the supplied resource. Depending on the resource, this could result in local file reads or server-side requests to internal HTTP resources. The acceptance form’s send a copy option is ticked by default, meaning the attacker receives the results directly in their own inbox without needing access to an administrator’s mailbox.

This created a path to access information that would otherwise be unavailable to the attacker, including potentially sensitive application configuration such as the .env file discussed earlier.

Snipe-IT addressed the vulnerability in version 8.7.0.

Read the full CVE-2026-86751 technical write-up.

What These Findings Have in Common

Although the seven vulnerabilities affect different applications and features, several of them share a common theme.

Security controls are only effective if they are applied consistently throughout the request lifecycle.

The ClipBucket SQL injection findings show how a sanitisation function can appear to protect an application while still being bypassed by unexpected input types. The image upload vulnerability shows why validating the contents of a file is not enough when its filename and eventual execution path are also security-sensitive.

The rConfig findings demonstrate another important point. The severity of a vulnerability cannot always be understood from the vulnerable function alone. A file read becomes significantly more serious when the exposed file contains application secrets that can be used to compromise the wider application and its managed infrastructure.

The Snipe-IT finding similarly crossed several trust boundaries. User-controlled Markdown was processed by the application, passed through mail functionality and ultimately used to retrieve resources from the server’s environment. The fact that the exfiltrated content was delivered directly to the attacker through a default-enabled feature made the issue practical to exploit in real-world conditions.

These are the kinds of issues that can be difficult to identify through automated scanning alone. Following data through the application’s source code can reveal how individual weaknesses combine with application behaviour to produce a practical attack path.

Vendor Response and Remediation

The vulnerabilities were responsibly disclosed to the affected maintainers. All vendors responded promptly and released fixes.

Organisations running affected versions should review the relevant vendor advisories and upgrade to a supported version containing the applicable security fixes.

Where multiple vulnerabilities affect the same product, organisations should ensure that the version deployed addresses all applicable findings rather than checking for a fix for only one CVE.

Learn More

To learn more about Source Code Review at Sekuro, visit our application security services.