CVE-2026-96272: ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can target the affected photo search endpoint. No account or user interaction is required.
What information could be exposed?
An attacker can use time-based blind SQL injection to extract user credentials, email addresses, and administrator password hashes. Exposed administrator hashes could enable account takeover.
Are installations before the fixed release affected by default?
The affected functionality is the photo search endpoint in ClipBucket v5 before 5.5.3-#182. The provided data does not state whether that endpoint must be separately enabled or configured.
How can I determine whether my instance is vulnerable?
Check whether the deployment runs ClipBucket v5 earlier than 5.5.3-#182 and exposes the photo search endpoint. The issue involves unsanitized query input reaching SQL WHERE and ORDER BY clauses.