CVE-2026-49482

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wv43-277p-737c
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wv43-277p-737c

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) ClipBucket v5 es una plataforma de código abierto para compartir videos. Antes de la versión 5.5.3 - #141, ClipBucket v5 contiene una neutralización incorrecta de caracteres comodín SQL en el endpoint de edición de subtítulos. Un usuario autenticado puede enviar un carácter ’%’ como parámetro ’number’ para sobrescribir todos los títulos de los subtítulos de cualquier video de su propiedad en una única solicitud HTTP. Este problema ha sido parcheado en la versión 5.5.3 - #141.

Information

Published : 2026-06-12 00:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-49482

Mitre link : CVE-2026-49482

CVE.ORG link : CVE-2026-49482

JSON object : View

Products Affected

No product.

CWE

CWE-155

Improper Neutralization of Wildcards or Matching Symbols

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

{"id": "CVE-2026-49482", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49482", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T13:36:53.029345Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MacWarrior", "product": "clipbucket-v5", "versions": [{"status": "affected", "version": "< 5.5.3 - #141"}]}]}], "published": "2026-06-12T00:16:19.363", "references": [{"url": "https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wv43-277p-737c", "source": "security-advisories@github.com"}, {"url": "https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wv43-277p-737c", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-155"}, {"lang": "en", "value": "CWE-943"}]}], "descriptions": [{"lang": "en", "value": "ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141."}, {"lang": "es", "value": "ClipBucket v5 es una plataforma de c\u00f3digo abierto para compartir videos. Antes de la versi\u00f3n 5.5.3 - #141, ClipBucket v5 contiene una neutralizaci\u00f3n incorrecta de caracteres comod\u00edn SQL en el endpoint de edici\u00f3n de subt\u00edtulos. Un usuario autenticado puede enviar un car\u00e1cter \u2019%\u2019 como par\u00e1metro \u2019number\u2019 para sobrescribir todos los t\u00edtulos de los subt\u00edtulos de cualquier video de su propiedad en una \u00fanica solicitud HTTP. Este problema ha sido parcheado en la versi\u00f3n 5.5.3 - #141."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}