Executive Summary

CVE-2026-49482 is a SQL Wildcard Injection vulnerability in ClipBucket v5 versions 5.5.3 and earlier. It occurs in the subtitle editing endpoint where an authenticated user can exploit improper neutralization of SQL wildcard characters, specifically the % character, in the number parameter.

The vulnerability arises because the application uses the SQL LIKE operator combined with a cleaning function that escapes standard SQL injection characters but fails to neutralize wildcard characters like % and _. By sending % as the number parameter, an attacker can match and overwrite all subtitle titles of any video they own in a single HTTP request.

This flaw can be exploited by any registered user with edit_video permissions without requiring admin interaction. The issue has been fixed by replacing the LIKE operator with an equality check and validating the number parameter format.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user with edit_video permissions to overwrite all subtitle titles of any video they own in a single HTTP request. This can lead to unauthorized mass modification of video subtitles, potentially causing data integrity issues and disrupting the user experience.

While it does not allow for data disclosure or system takeover, the integrity impact is considered low but can still affect the reliability and trustworthiness of the video content on the platform.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the subtitle editing endpoint of ClipBucket v5 for suspicious usage of the number parameter containing SQL wildcard characters such as '%'. Specifically, look for authenticated user requests where the number parameter is set to '%', which is used to overwrite all subtitle titles of videos owned by the user.

A practical detection method is to analyze web server logs or use network monitoring tools to filter HTTP POST or GET requests to the subtitle editing endpoint that include the number parameter with the value '%'.

Example command to search web server logs (assuming logs are in access.log):

• grep -i 'number=%' access.log

Alternatively, if you have access to the application database or logs, check for unexpected mass updates to subtitle titles or audit logs showing multiple subtitle title changes triggered by a single request.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade ClipBucket v5 to version 5.5.3 - #141 or later, where this vulnerability has been patched.

If upgrading immediately is not possible, restrict or monitor authenticated users with edit_video permissions to prevent misuse of the subtitle editing endpoint.

Additionally, implement input validation on the number parameter to ensure it matches the expected two-digit format and does not contain wildcard characters like '%'.

Review and apply the recommended code fix by replacing the SQL LIKE operator with an equality check (=) in the update_subtitle() function to prevent wildcard injection.

Useful 0 Not Useful 0