CVE-2026-42847 ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Authenticated attackers can perform SQL injection via the type parameter in ClipBucket admin logs, leading to database data exfiltration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42847?
CVE-2026-42847 is a high-severity SQL injection vulnerability in MacWarrior clipbucket-v5, published on 14 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint admin_area/action_logs.php. The endpoint admin_area/action_logs.php reads $_GET['type'], stores it in $result_array['type'], and forwards it into fetch_action_logs(), where the value is concatenated directly into a SQL WHERE condition on action_type without parameterization. This allows UNION-based SQL injection and direct data exfiltration from the database. This vulnerability is fixed in 5.5.3 - #122.
Weakness: CWE-89
Which versions are affected by CVE-2026-42847?
How do I fix CVE-2026-42847?
No fix has been published for CVE-2026-42847 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-42847 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42847 exists.