# CVE-2026-45418: MacWarrior ClipBucket SQL injection in subtitle_edit.php

Source: https://junglewise.ai/threats/cve-2026-45418-macwarrior-clipbucket-sql-injection-in-subtitle-edit-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-45418 · Severity: high · CVSS 8.8 · Published 2026-06-11

ClipBucket, an open-source video sharing platform, contains a security flaw that allows registered users to manipulate the site's database. By exploiting the video subtitle editing feature, an attacker can bypass security controls to view sensitive information or modify data they should not have access to. This could lead to the theft of user credentials or unauthorized changes to video content.

Technologies: [MacWarrior ClipBucket](https://junglewise.ai/threats/technologies/clipbucket). Vendors: [MacWarrior](https://junglewise.ai/threats/vendors/macwarrior).

## Quick answers

**Is CVE-2026-45418 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45418 being exploited in the wild.

**How severe is CVE-2026-45418?** High severity, with a CVSS score of 8.8, published 11 June 2026.

**Which products and versions are affected?** MacWarrior ClipBucket < 5.5.3 - #132.

**Is there a fix for CVE-2026-45418?** A patch was published on 2026-06-11: Fix released in version 5.5.3 - #132 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45418 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45418?** Check whether you run MacWarrior ClipBucket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A boolean-based blind SQL injection vulnerability exists in ClipBucket v5 prior to version 5.5.3 - #132. The flaw is located in the `update_subtitle` function within `upload/includes/classes/video.class.php`, where the `number` parameter from a POST request to `/actions/subtitle_edit.php` is concatenated directly into a SQL UPDATE query without sanitization. An authenticated attacker with video upload permissions can inject arbitrary SQL commands via this parameter. By observing whether the subtitle title successfully updates (the 'oracle'), an attacker can perform blind data exfiltration. This can also be combined with IDOR to affect videos belonging to other users. The issue is fixed in version 5.5.3 - #132 by implementing proper parameter handling.

## Affected products

- MacWarrior ClipBucket < 5.5.3 - #132

## Timeline

- 2026-05-18: advisory: Original GitHub security advisory published
- 2026-06-11: disclosed: CVE published to NVD
- 2026-06-11: patched: Fix released in version 5.5.3 - #132

## References

- [https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-q233-m544-6jqr](https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-q233-m544-6jqr)

## Related threats

- [ClipBucket reflected XSS in language settings](https://junglewise.ai/threats/cve-2026-110626-clipbucket-v5-through-5-5-3-206-contains-a-reflected-cross-site)
- [ClipBucket v5 reflected XSS in admin flagged_item.php](https://junglewise.ai/threats/cve-2026-110625-clipbucket-v5-through-5-5-3-206-contains-a-reflected-cross-site)
- [ClipBucket SQL injection in ads manager](https://junglewise.ai/threats/cve-2026-103766-clipbucket-v5-through-5-5-3-197-contains-an-sql-injection)
- [ClipBucket time-based blind SQL injection in language update](https://junglewise.ai/threats/cve-2026-102570-clipbucket-v5-through-5-5-3-197-contains-a-time-based-blind-sql)
- [ClipBucket time-based SQL injection in admin video edit](https://junglewise.ai/threats/cve-2026-102569-clipbucket-v5-through-5-5-3-197-contains-a-time-based-blind-sql)