Executive brief
ClipBucket is an open-source video sharing platform used to host and manage video content. A security flaw in the administrative logging system allows an authorized user with low-level permissions to gain unauthorized access to the underlying database. This could lead to the theft of sensitive information, including user credentials, email addresses, and system configuration data.
Technical details
A SQL injection vulnerability exists in ClipBucket v5 prior to version 5.5.3 - #122 due to improper neutralization of the 'type' GET parameter in the admin_area/action_logs.php endpoint. The application takes the user-supplied value and passes it to the fetch_action_logs() function, where it is concatenated directly into a SQL WHERE clause without parameterization or validation. An authenticated attacker with at least low-level administrative access can use UNION-based SQL injection to exfiltrate arbitrary data from the database, including user hashes and system metadata. The issue is resolved in version 5.5.3 - #122 by implementing better input handling.
Affected products
- MacWarrior ClipBucket < 5.5.3 - #122
Timeline
- 2026-05-04: advisory: Original GitHub security advisory published
- 2026-05-14: disclosed: CVE-2026-42847 published to NVD