# CVE-2026-42847: MacWarrior ClipBucket SQL injection in action_logs.php

Source: https://junglewise.ai/threats/cve-2026-42847-macwarrior-clipbucket-sql-injection-in-action-logs-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-42847 · Severity: info · CVSS 7.1 · Published 2026-05-14

ClipBucket is an open-source video sharing platform used to host and manage video content. A security flaw in the administrative logging system allows an authorized user with low-level permissions to gain unauthorized access to the underlying database. This could lead to the theft of sensitive information, including user credentials, email addresses, and system configuration data.

Technologies: [MacWarrior ClipBucket](https://junglewise.ai/threats/technologies/clipbucket). Vendors: [MacWarrior](https://junglewise.ai/threats/vendors/macwarrior).

## Quick answers

**Is CVE-2026-42847 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42847 being exploited in the wild.

**How severe is CVE-2026-42847?** Informational severity, with a CVSS score of 7.1, published 14 May 2026.

**Which products and versions are affected?** MacWarrior ClipBucket < 5.5.3 - #122.

**Is there a fix for CVE-2026-42847?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42847 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42847?** Check whether you run MacWarrior ClipBucket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in ClipBucket v5 prior to version 5.5.3 - #122 due to improper neutralization of the 'type' GET parameter in the admin_area/action_logs.php endpoint. The application takes the user-supplied value and passes it to the fetch_action_logs() function, where it is concatenated directly into a SQL WHERE clause without parameterization or validation. An authenticated attacker with at least low-level administrative access can use UNION-based SQL injection to exfiltrate arbitrary data from the database, including user hashes and system metadata. The issue is resolved in version 5.5.3 - #122 by implementing better input handling.

## Affected products

- MacWarrior ClipBucket < 5.5.3 - #122

## Timeline

- 2026-05-04: advisory: Original GitHub security advisory published
- 2026-05-14: disclosed: CVE-2026-42847 published to NVD

## References

- [https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-x33j-5cqg-vrrc](https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-x33j-5cqg-vrrc)

## Related threats

- [ClipBucket reflected XSS in language settings](https://junglewise.ai/threats/cve-2026-110626-clipbucket-v5-through-5-5-3-206-contains-a-reflected-cross-site)
- [ClipBucket v5 reflected XSS in admin flagged_item.php](https://junglewise.ai/threats/cve-2026-110625-clipbucket-v5-through-5-5-3-206-contains-a-reflected-cross-site)
- [ClipBucket SQL injection in ads manager](https://junglewise.ai/threats/cve-2026-103766-clipbucket-v5-through-5-5-3-197-contains-an-sql-injection)
- [ClipBucket time-based blind SQL injection in language update](https://junglewise.ai/threats/cve-2026-102570-clipbucket-v5-through-5-5-3-197-contains-a-time-based-blind-sql)
- [ClipBucket time-based SQL injection in admin video edit](https://junglewise.ai/threats/cve-2026-102569-clipbucket-v5-through-5-5-3-197-contains-a-time-based-blind-sql)