CVE-2026-26005
Last modified
CVE-2026-26005 is a medium-severity vulnerability rated 5/10 on the CVSS scale. ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SSRF can be triggered, causing GET requests to be sent to internal servers. An attacker can exploit this to scan the internal network. Even a regular (non-privileged) user can carry out the attack.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Oxygenz | Clipbucket | >= 5.3, < 5.5.3-45 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-26005?
How severe is CVE-2026-26005?
How do I fix CVE-2026-26005?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2600The ElementsKit Elementor Addons and Templates plugin for Wo…6.4
- CVE-2026-26000XWiki Platform is a generic wiki platform offering runtime s…6.1
- CVE-2026-26001The GLPI Inventory Plugin handles network discovery, invento…8.8
- CVE-2026-26002Open OnDemand is an open-source high-performance computing p…9.8
- CVE-2026-26003FastGPT is an AI Agent building platform. From 4.14.0 to 4.1…5.4
- CVE-2026-26004Sentry is a developer-first error tracking and performance m…6.5
- CVE-2026-26006AutoGPT is a platform that allows users to create, deploy, a…6.5
- CVE-2026-26007cryptography is a package designed to expose cryptographic p…6.5
- CVE-2026-26008EVerest is an EV charging software stack. Versions prior to …7.5
- CVE-2026-26009Catalyst is a platform built for enterprise game server host…9.9
- CVE-2026-2601GitLab has remediated an issue in GitLab EE affecting all ve…4.3
- CVE-2026-26010OpenMetadata is a unified metadata platform. Prior to 1.11.8…7.6
Are you affected by CVE-2026-26005?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST