CVE-2026-45418: ClipBucket: Blind SQL Injection in subtitle_edit.php
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitleedit.php request used to change their title includes a number parameter which is vulnerable to SQL Injection. A boolean-based blind SQL injection can be used to exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #132.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ClipBucketto a version that resolves this vulnerability.Fixed in 5.5.3 - #132
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45418?
The severity of CVE-2026-45418 is rated high with a CVSS score of 8.8.
How do I fix CVE-2026-45418?
To fix CVE-2026-45418, upgrade to ClipBucket version 5.5.3 or later.
What type of vulnerability is CVE-2026-45418?
CVE-2026-45418 is a blind SQL injection vulnerability affecting ClipBucket.
Who is affected by CVE-2026-45418?
Authenticated users who can upload videos on ClipBucket v5 prior to 5.5.3 are affected by CVE-2026-45418.
What is the impact of CVE-2026-45418?
The impact of CVE-2026-45418 allows attackers to manipulate SQL queries, potentially leading to unauthorized data access.