CVE-2026-49482: ClipBucket v5 SQL Wildcard Injection in Subtitle Editing

Technical summary

CVE-2026-49482 is an improper neutralization of SQL wildcard characters (CWE-155, CWE-943) in ClipBucket v5's subtitle editing endpoint. The vulnerability exists because the endpoint fails to properly escape or validate the 'number' parameter, allowing SQL wildcard characters (specifically the '%' character) to be processed as metacharacters rather than literal input. When an authenticated user submits a '%' as the number parameter, the backend SQL query expands this wildcard to match all subtitle records associated with a video, resulting in batch overwrite of subtitle titles. The impact is limited to the authenticated user's own videos, and does not enable unauthorized access to other users' content.

Business impact

Organizations running ClipBucket v5 for video hosting face risk of content metadata corruption by internal or compromised user accounts. Users with editing permissions can render subtitle data unusable across their entire video library in seconds, potentially disrupting viewer experience and requiring manual remediation. For platforms with strict content delivery SLAs or regulatory compliance around data integrity, this introduces operational friction and potential audit findings. The threat model is limited to authenticated internal actors, reducing enterprise-wide blast radius compared to unauthenticated exploits.

Affected systems

ClipBucket v5 versions prior to 5.5.3 - #141 are affected. The vulnerability requires an authenticated user account with video ownership or editing permissions. Open-source deployments self-hosted on-premises are the primary exposure vector; no third-party commercial distributions are listed in vendor records.

Exploitability

Exploitability is straightforward for authenticated users. No special tools, timing, or user interaction are required beyond crafting a single HTTP request with a malformed parameter. The attack requires valid login credentials and ownership of at least one video, which constrains exploitation to insiders or accounts obtained through credential compromise. The attack is repeatable and leaves audit trails in request logs. External threat actors face a credential acquisition barrier; exploitation likelihood increases significantly in scenarios involving disgruntled staff or phished user accounts.

Remediation

Organizations should upgrade ClipBucket to version 5.5.3 - #141 or later. For deployments unable to patch immediately, restrict subtitle editing permissions to trusted administrative users and monitor access logs for anomalous subtitle modification activity. Consider implementing database-level access controls to limit the scope of subtitle table modifications.

Patch guidance

Verify and apply ClipBucket version 5.5.3 - #141 or later according to the vendor's upgrade documentation. Since ClipBucket is open-source, organizations managing self-hosted instances should pull the latest release from the official repository, review the changelog to confirm the patch is included, and test in a staging environment before production deployment. No dependency changes or configuration adjustments are noted as required for this patch.

Detection guidance

Monitor application logs and database query logs for unusual patterns in subtitle modification requests, particularly those containing '%' characters in numeric parameters or bulk subtitle rewrites. Web application firewalls can be configured to flag HTTP requests to the subtitle editing endpoint that contain SQL metacharacters in the number parameter. Track subtitle edit timestamps and volumes per user account to identify spike anomalies. Perform periodic audits of subtitle metadata to detect unexplained bulk changes to titles.

Why prioritize this

Although rated MEDIUM severity with a CVSS score of 4.3, this vulnerability merits prompt patching due to its trivial exploitation simplicity and potential for rapid, widespread data corruption across an organization's entire video library. The attack is guaranteed to succeed if preconditions are met, leaves minimal forensic ambiguity, and offers no compensating controls in the application layer. However, the requirement for authentication and the limitation to owned videos reduce it below HIGH priority for enterprises with strong credential hygiene and role-based access controls.

Risk score, explained

The CVSS v3.1 score of 4.3 (MEDIUM) reflects low attack complexity, no special privileges required beyond basic user authentication, and integrity impact confined to video subtitle metadata without confidentiality or availability loss. The network attack vector and lack of user interaction increase the base score relative to local attacks. The score appropriately discounts the threat from authenticated-only access; in environments where user accounts are widely distributed or credentials are commonly compromised, defensive value of authentication weakens significantly.

Frequently asked questions