CVE-2026-110626 Details
Description
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.
A reflected cross-site scripting vulnerability has been identified in ClipBucket versions 5.0 through 5.5.3-#206. The issue resides in the 'admin_area/language_settings.php' file, where the unencoded 'edit_language' GET parameter allows attackers to inject malicious scripts. These scripts are echoed into a hidden input field, executing in the context of the admin panel.
The application should properly encode user input before reflecting it in the response. Additionally, the 'edit_language' parameter should be validated to ensure it meets expected data formats.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@leediay/BJR_lh2ifg | CISA-ADP | BundleExploitRemedyTechnical Description |
| https://github.com/MacWarrior/clipbucket-v5 | [email protected] | ProductVendor |
| https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1341b7a486/upload/admin_area/language_settings.php#L32-L37 | [email protected] | Source CodeVendor |
| https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1341b7a486/upload/admin_area/styles/cb_2014/layout/blocks/language_edit.html#L40 | [email protected] | Source CodeVendor |
| https://github.com/MacWarrior/clipbucket-v5/commit/0c1b5878a6135950d8a516975c4585e3b7c8790d | [email protected] | Source CodeVendor |
| https://hackmd.io/@leediay/BJR_lh2ifg | [email protected] | BundleExploitRemedyTechnical Description |
| https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-206-reflected-xss-via-edit-language-in-language-settings-php | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ClipBucket | <= 5.5.3-#206 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |