CVE-2026-95812: ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sortlink() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ClipBucket v5 versions before 5.5.3-#182 are affected. The issue is in the sort_link() helper function.
What must an attacker do to exploit this?
An attacker must craft a request containing an injected script payload in the cat, sort, or time query parameter and induce a victim to load it. No attacker privileges are required, but victim interaction is required.
What is the impact if exploitation succeeds?
Injected JavaScript executes in the victim's browser under the ClipBucket application origin. This can affect confidentiality and integrity in that browser context.
What should be done to remediate the issue?
Upgrade to ClipBucket v5.5.3-#182 or later, which is the first version identified as not affected.