CVE-2026-77927 is a blind SQL injection vulnerability in ClipBucket v5 through 5.5.3. Authenticated users can exploit this by submitting the check_photo parameter as an array, bypassing the clean_requests() sanitization function in ClipBucket.class.php. Unsanitized array elements are passed through the bulk deletion handler in manage_photos.php to photo_exists() in photos.class.php, where non-numeric values are directly interpolated into a SQL query. This enables time-based blind SQL injection attacks to extract sensitive data from the database, including credential hashes.

An attacker with authenticated access can exploit this vulnerability to perform time-based blind SQL injection, allowing extraction of arbitrary data from the database. This includes sensitive information such as credential hashes, which could lead to further compromise if leveraged.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to minimize exposure and monitor for suspicious activity related to photo management functions.