CVE-2026-77927: ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the bulk deletion handler in managephotos.php to photoexists() in photos.class.php, where non-numeric values are interpolated directly into a SQL query, enabling time-based blind SQL injection to retrieve credential hashes and other sensitive data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ClipBucketto a version that resolves this vulnerability.Fixed in 5.5.3-#182
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated with an account that can reach the photo-deletion functionality. No user interaction is required once the attacker has that access.
What data could be exposed through exploitation?
An attacker can use time-based blind SQL injection to extract arbitrary database data, including credential hashes and other sensitive information.
Which product versions are identified as affected?
ClipBucket v5 through 5.5.3 are identified as affected by the provided information.