PT-2026-41126 · Unknown · Clipbucket

Macwarrior · Published 2026-05-14 · Updated 2026-05-16 · CVE-2026-42847

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3 - #122

Description An SQL Injection (SQLi) issue exists in the authenticated admin endpoint "admin area/action logs.php". The endpoint processes the type parameter, which is passed to the fetch action logs() function and concatenated directly into a SQL WHERE condition on action type without parameterization. This allows for UNION-based SQL injection, enabling direct data exfiltration from the database.

Recommendations Update to version 5.5.3 - #122. As a temporary workaround, restrict access to the "admin area/action logs.php" endpoint or avoid using the type parameter until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-42847

Affected Products

Clipbucket

References · 6

• 🔥 https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-x33j-5cqg-vrrc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42847 · Security Note
• https://t.me/CVEtracker/53836 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2055106137821770230 · Twitter Post
• https://t.me/cveNotify/163710 · Telegram Post
• https://twitter.com/CVEnew/status/2055074223261938108 · Twitter Post