CVE-2026-95812: ClipBucket v5 Reflected XSS Vulnerability

CVE-2026-95812 Overview

CVE-2026-95812 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in ClipBucket v5 versions prior to 5.5.3-#182. The flaw resides in the sort_link() helper function, which fails to sanitize the cat, sort, and time query parameters before reflecting them into rendered HTML. Attackers can craft malicious URLs that inject arbitrary JavaScript into a victim's browser session under the application origin. Successful exploitation requires user interaction, typically through clicking a crafted link. The vulnerability affects the front-office search functionality of the ClipBucket video-sharing platform.

Critical Impact
Reflected XSS allows attackers to execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions performed under the victim's authenticated context.

Affected Products

ClipBucket v5 versions prior to 5.5.3-#182
Deployments using the vulnerable sort_link() helper in upload/includes/functions.php
Front-office search and category listing pages that render cat, sort, and time parameters

Discovery Timeline

2026-09-22 - CVE-2026-95812 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95812

Vulnerability Analysis

The vulnerability exists in the sort_link() helper function inside upload/includes/functions.php. The function reads user-controllable values from $_GET['cat'], $_GET['sort'], and $_GET['time'] and reflects them into generated hyperlinks and page markup without HTML encoding or type enforcement. Because the reflected content is placed into an HTML context, attackers can break out of attribute or tag boundaries by supplying script payloads. The reflected script executes with the same origin as the ClipBucket application, giving it access to session cookies, DOM content, and any authenticated API endpoints. The VulnCheck advisory documents the parameters and confirms exploitation through crafted search links.

Root Cause

The root cause is missing input validation and output encoding in the query-parameter handling of sort_link(). The original code accepted arbitrary strings from $_GET['sort'] and $_GET['time'] and stored them directly in local variables that were later concatenated into HTML output. The page parameter was likewise untyped. This pattern conforms to a classic reflected XSS anti-pattern where request data flows unchanged from source to sink.

Attack Vector

An attacker delivers a URL containing script payloads in the cat, sort, or time query parameters to a target user. When the victim loads the page, ClipBucket reflects the payload into the DOM and the browser executes it under the site origin. Delivery typically occurs through phishing emails, malicious posts, or crafted links on third-party sites. Authentication is not required to trigger reflection, but active user interaction is required to reach the vulnerable endpoint.

php

// Source: https://github.com/MacWarrior/clipbucket-v5/commit/032f46937e091e22afa6c99f2c888575cc94e44b
// Patch to upload/includes/functions.php - removes unsanitized $_GET['sort']
// intake and casts $_GET['page'] to an integer.

    //default value
-    $time = $_GET['time'] ?? 'all_time';
-    $page = $_GET['page'] ?? '1';
-    if (isset($_GET['sort'])) {
-        $sort = $_GET['sort'];
-    } else {
-        if (Update::IsCurrentDBVersionIsHigherOrEqualTo('5.5.1', '299')) {
-            $sort = SortType::getDefaultByType($type)['id'];
-        } else {
-            $sort = 0;
-        }
+    $time = $_GET['time'] ?? null;
+    $page = (int)$_GET['page'] ?? '1';
+    $sort = 0;
+    if (Update::IsCurrentDBVersionIsHigherOrEqualTo('5.5.1', '299')) {
+        $sort = SortType::getDefaultByType($type)['id'];
     }
     if (config($config_enable_category) != 'yes') {
         $cat ='';

The patch replaces direct assignment from $_GET['sort'] with a server-controlled default and casts $_GET['page'] to an integer, eliminating the injection sink. See the ClipBucket commit log entry for the full change set.

Detection Methods for CVE-2026-95812

Indicators of Compromise

Web server access logs containing cat=, sort=, or time= parameters with HTML entities, <script>, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E
Referer headers pointing to unfamiliar external domains that direct users to ClipBucket search or listing endpoints
Unexpected outbound requests from user browsers to attacker-controlled hosts immediately after loading a ClipBucket page

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the cat, sort, and time query parameters for scripting metacharacters and known XSS payload signatures
Add server-side logging that captures the full query string for ClipBucket front-office endpoints to support retrospective hunting
Correlate suspicious query strings with subsequent authentication anomalies or session token reuse from new IP addresses

Monitoring Recommendations

Monitor HTTP 200 responses from ClipBucket search endpoints where request parameters contain angle brackets or JavaScript event handlers
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts
Track user-agent and IP diversity for requests carrying non-default sort or time values, which are common exploitation targets

How to Mitigate CVE-2026-95812

Immediate Actions Required

Upgrade ClipBucket v5 to release 5.5.3-#182 or later, which contains the sanitization fix
Apply a WAF rule to block requests with scripting payloads in the cat, sort, and time parameters until patching completes
Invalidate active administrator sessions after patching to reduce risk from any pre-existing session theft

Patch Information

The fix is included in the ClipBucket 5.5.3-#182 release. The upstream commit removes direct assignment of $_GET['sort'] and forces $_GET['page'] to an integer inside upload/includes/functions.php. Administrators should validate the deployment by inspecting the modified sort_link() code path against the upstream commit. Additional context is available in the VulnCheck advisory and the HackMD reflected XSS analysis.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Deploy virtual patching at the reverse proxy or WAF layer to strip or reject scripting metacharacters in the affected query parameters
Restrict access to the ClipBucket front office using IP allowlists where the deployment is not intended for public use

bash

# Example ModSecurity rule to block XSS payloads in vulnerable parameters
SecRule ARGS:cat|ARGS:sort|ARGS:time "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
    "id:1009581,phase:2,deny,status:403,log,msg:'CVE-2026-95812 ClipBucket XSS attempt blocked'"