CVE-2026-42847: ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint adminarea/actionlogs.php. The endpoint adminarea/actionlogs.php reads $GET['type'], stores it in $resultarray['type'], and forwards it into fetchactionlogs(), where the value is concatenated directly into a SQL WHERE condition on actiontype without parameterization. This allows UNION-based SQL injection and direct data exfiltration from the database. This vulnerability is fixed in 5.5.3 - #122.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42847?
CVE-2026-42847 has been classified as critical due to its potential for SQL injection attacks that can compromise the database.
How do I fix CVE-2026-42847?
To fix CVE-2026-42847, upgrade ClipBucket to version 5.5.3 or later, where the vulnerability has been addressed.
What are the consequences of exploiting CVE-2026-42847?
Exploitation of CVE-2026-42847 can lead to unauthorized database access, data manipulation, or data leakage.
Which versions of ClipBucket are affected by CVE-2026-42847?
CVE-2026-42847 affects all versions of ClipBucket prior to 5.5.3.
How can I tell if my site is vulnerable to CVE-2026-42847?
You may determine if your site is vulnerable to CVE-2026-42847 by checking if it runs a version of ClipBucket earlier than 5.5.3.