ClipBucket v5 CVE-2026-110625

Exploitation requires the attacker to deliver a crafted URL to the vulnerable endpoint admin_area/flagged_item.php with a malicious value in the type GET parameter, AND a currently authenticated administrator or moderator must actively click/open that link while logged into the admin panel (CVSS UI:A confirms required victim interaction). Limiting factors: the payload only executes in the context of an already-authenticated admin/moderator session, so it cannot be triggered against anonymous users or the server directly; it is a reflected (non-persistent) vector, meaning each victim must individually open the attacker-supplied link; and the vendor patch restricts $type to the Flag::getFlagElementTypes() allowlist, neutralizing the injection on updated builds (through 5.5.3-#206 affected).

This is a reflected cross-site scripting flaw (CWE-79) in ClipBucket v5's admin_area/flagged_item.php, reported by VulnCheck with a vendor patch available. The only severity signal provided is a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1): network vector, low complexity, no attacker privileges, but requiring active user interaction (UI:A) from the victim, with impact limited to subsequent-system confidentiality and integrity (SC:L/SI:L) - consistent with script executing in the admin panel origin rather than compromising the vulnerable server itself. No EPSS score, KEV listing, or POC flag was supplied; accordingly this is no public exploit identified at time of analysis and is not confirmed actively exploited. The practical risk is moderate and contingent: exploitation depends on social-engineering a logged-in administrator or moderator into clicking a crafted link, so despite the AV:N/PR:N network reachability this is a targeted, interaction-gated issue rather than a wormable or mass-exploitable one. Treat it as a meaningful but not emergency priority - patch in normal cycle - with the main caveat that a security researcher writeup (hackmd) and a VulnCheck advisory exist, which lowers the barrier to someone weaponizing it even though no exploit artifact is confirmed in the input.

An attacker crafts a flagged_item.php?type= URL embedding malicious JavaScript in the unencoded type parameter and sends it (via email, chat, or a planted link) to a ClipBucket administrator or moderator. When the authenticated victim opens the link, the reflected payload executes in the admin panel origin, letting the attacker run actions as the admin, steal session context, or pivot within the admin interface. A hackmd writeup and VulnCheck advisory describe the issue, but no confirmed public exploit code was provided in the input.