CVE-2026-77927: ClipBucket 5.5.3 Blind SQL Injection via Photo Deletion Endpoint
ClipBucket v5 through 5.5.3 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the bulk deletion handler in managephotos.php to photoexists() in photos.class.php, where non-numeric values are interpolated directly into a SQL query, enabling time-based blind SQL injection to retrieve credential hashes and other sensitive data.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated with an account that can reach the photo-deletion functionality. No user interaction is required once the attacker has that access.
What data could be exposed through exploitation?
An attacker can use time-based blind SQL injection to extract arbitrary database data, including credential hashes and other sensitive information.
Which product versions are identified as affected?
ClipBucket v5 through 5.5.3 are identified as affected by the provided information.