CVE-2026-110627: ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
ClipBucket installations running v5 through 5.5.3-#206 are exposed when an administrator is logged in and can be induced to submit an attacker-controlled cross-site POST request.
What does an attacker need to exploit this issue?
The attacker does not need authentication, but must lure a logged-in administrator into submitting a POST form targeting admin_area/index.php with mode=add_todo and a malicious val parameter.
Are administrators affected simply by viewing a malicious link or page?
The described attack requires the administrator to submit a cross-site POST form. Successful exploitation executes attacker-supplied script in the administrative panel's origin.
How can I determine whether my instance is affected?
Check whether the deployment is ClipBucket v5 through 5.5.3-#206 and whether admin_area/index.php handles mode=add_todo with the val parameter. The affected path lacks CSRF protection in the described attack flow.