CVE-2026-42847 is a SQL Injection vulnerability (CWE-89) in ClipBucket v5, an open source video sharing platform. The flaw exists in the admin endpoint admin_area/action_logs.php, where the 'type' parameter from the GET request is stored and passed into a function that concatenates it directly into a SQL WHERE clause without parameterization. This improper neutralization of special elements enables UNION-based SQL injection attacks, allowing an authenticated admin user to extract data from the database. The vulnerability affects versions prior to 5.5.3 and was fixed in that release.

An attacker with authenticated admin access can exploit this vulnerability to perform UNION-based SQL injection, potentially leading to unauthorized data disclosure from the backend database. The vulnerability does not require user interaction beyond authentication and has a high impact on confidentiality. There is no indication of privilege escalation or remote unauthenticated exploitation in the provided data.

Upgrade ClipBucket to version 5.5.3 or later, where this SQL Injection vulnerability is fixed. Since the vendor advisory confirms the fix in 5.5.3, applying this official patch is the recommended remediation. No other mitigation guidance is provided or necessary based on the available information.