CVE-2026-102570: ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject arbitrary SQL payloads to extract or modify database contents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ClipBucket administrator who has the basic_settings permission can exploit it. The supplied data does not indicate that lower-privileged users or unauthenticated attackers can reach the vulnerable function.
What access does an attacker need to perform the injection?
The attacker needs administrative authentication and the basic_settings permission, then must be able to supply a crafted language_id value to the language update function. The injection occurs because that value is concatenated into the WHERE clause of an UPDATE statement without escaping.
What could a successful attacker do?
A successful attacker can use time-based blind SQL injection payloads to extract database contents or modify them. The listed impact indicates high confidentiality impact and low integrity impact, with no availability impact.
Which releases are affected?
ClipBucket v5 through 5.5.3-#197 are identified as affected. The provided data does not state which release first contains the fix.