ClipBucket EUVD-2026-88971

Requires an authenticated ClipBucket v5 administrator account holding the basic_settings permission (PR:H); the attacker must reach the language update function (update_lang) and supply a malicious language_id parameter. Affected versions are ClipBucket v5 up to and including 5.5.3-#197. Exploitation is network-reachable and needs no user interaction beyond the attacker's own authenticated session, but the high-privilege requirement is the primary limiting factor - it is not exploitable by unauthenticated or low-privilege users, and patched builds (post commit ecbdf2d5) are not affected.

Multiple signals converge on a MODERATE, gated risk. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N/VC:H) scores 7.0, and the critical gating metric is PR:H - exploitation requires an authenticated administrator holding the basic_settings permission, so this is a post-authentication, privileged-user issue rather than a broadly exploitable network flaw. A public POC exists (hackmd write-up by leediay) and VulnCheck published an advisory, so exploit code availability is confirmed; however there is NO CISA KEV listing and NO EPSS score was provided, meaning there is no evidence of active exploitation or widespread automated targeting. POC availability and active exploitation are distinct signals - here only the former is present. The source-code diff (commit ecbdf2d5) confirms the root cause precisely: user-controlled $array['language_id'] was concatenated unescaped into the UPDATE WHERE clause, and the fix substitutes a trusted $lang['language_id'] value. Net: a real, verifiable, patch-confirmed SQLi, but its practical priority is dampened by the high-privilege prerequisite and the product's small deployment footprint. This is a legitimate finding to patch, not an emergency; treat as medium priority for organizations actually running ClipBucket v5.

An authenticated administrator (or an attacker who has compromised such an account via phishing, credential reuse, or session hijack) with the basic_settings permission submits a crafted language_id value in the language update function, injecting a time-based blind SQL payload into the UPDATE WHERE clause. Using time-delay inference the attacker extracts arbitrary database contents (user records, password hashes, configuration) or modifies rows. A public POC write-up demonstrating the blind SQLi vectors is available on hackmd.