ClipBucket v5 EUVD-2026-84859

Exploitable remotely and without authentication against default ClipBucket v5 installations before 5.5.3-#182, but requires victim user interaction: the attacker must lure a user into opening a crafted URL whose cat, sort, or time query parameter contains an injected script payload processed by the unsanitized sort_link() helper. The main limiting factors are (1) required user interaction (UI:P - victim must click/visit the malicious link) and (2) impact confined to the victim's browser under the application origin (no server-side code execution). Value is highest when the victim is an authenticated user whose session or in-app actions can be abused.

This is a genuine but modest-severity issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, base 5.3) describes an unauthenticated, network-reachable reflected XSS whose exploitation depends on passive victim interaction (UI:P) - the victim must be induced to follow an attacker-crafted link. Impact is limited: only partial confidentiality/integrity in the browser context (VC:L/VI:L), no availability impact, and no server-side compromise. Exploitation signals are mixed: a public exploit write-up exists (hackmd.io PoC by lee/diay) and a vendor patch is available, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. Publicly available exploit code exists - this is distinct from active exploitation and should not be conflated. Net: a real, verify-and-patch-worthy web flaw typical of CMS reflected XSS, not an emergency. The CVSS vector and description are internally consistent (both point to reflected XSS via query parameters), so no signal conflict is present. Note the vendor scored VI:L/SI:L (some integrity), which is a defensible reading for XSS that can drive authenticated actions.

An attacker crafts a URL to a ClipBucket v5 listing/search page with a JavaScript payload injected into the cat, sort, or time query parameter, which sort_link() reflects unsanitized into the page. The attacker delivers this link to a logged-in user (e.g., via phishing or a forum post); when the victim clicks it, the script executes under the application origin and can steal session context or perform actions as the victim. A public proof-of-concept write-up for this reflected XSS is available on hackmd.io.