ClipBucket v5, an open source video sharing platform, has a high-severity SQL Injection vulnerability (CWE-89) identified as CVE-2026-42847. The flaw exists in the admin endpoint admin_area/action_logs.php where the 'type' parameter is read from the GET request, stored in a variable, and passed into a function that concatenates it directly into a SQL WHERE clause without parameterization. This allows an authenticated admin user to perform UNION-based SQL injection attacks, potentially leading to unauthorized data exfiltration. The vulnerability affects all versions prior to 5.5.3 and is resolved in version 5.5.3.

An attacker with authenticated admin access can exploit this vulnerability to execute arbitrary SQL commands via the 'type' parameter, enabling UNION-based SQL injection. This can lead to unauthorized disclosure of sensitive database information. The CVSS 4.0 score is 7.1 (high), reflecting the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

Upgrade ClipBucket to version 5.5.3 or later, where this SQL Injection vulnerability has been fixed. Since this is a code-level vulnerability fixed in the official release, applying the update is the recommended remediation. No other mitigations are specified or required if the patch is applied.