What’s Vulnerable › Vulnerabilities

CVE-2026-26005: ClipBucket v5 enables internal network scans via an SSRF vulnerability

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-12 · updated 2026-06-17
• Weakness: CWE-918

Description

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SSRF can be triggered, causing GET requests to be sent to internal servers. An attacker can exploit this to scan the internal network. Even a regular (non-privileged) user can carry out the attack.

Affected products

• MacWarrior clipbucket-v5: from 5.3 before 5.5.3-45 — fixed in 5.5.3-45

How to fix

Upgrade to a fixed version: MacWarrior clipbucket-v5 5.5.3-45. Check the vendor advisory for mitigations.

References

• https://github.com/MacWarrior/clipbucket-v5/commit/a9e0f2322fb37501dfd4f44079fc7826a132503a
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-69xj-2pq3-5r4v

Get alerted when CVE-2026-26005 or the next vulnerability affects your stack