PT-2026-7321 · Unknown · Clipbucket

M0X41Nos · Publicado 2026-02-10 · Atualizado 2026-02-18 · CVE-2026-25728

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3

Description ClipBucket is an open source video sharing platform. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before validating them, allowing an attacker to potentially execute arbitrary PHP code before the file is deleted. The vulnerability occurs because the uploaded file is moved to a web-accessible path using the move uploaded file() function, then validated using ValidateImage(). If validation fails, the file is deleted using @unlink().

Recommendations Update to version 5.5.3 or later.

Exploit

Correção

RCE

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-367

Identificadores relacionados

CVE-2026-25728

GHSA-XQ7C-M5R2-9WQJ

Produtos afetados

Clipbucket

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25728.json · Exploit
• 🔥 https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-xq7c-m5r2-9wqj · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/09536e6e2ca6d69a2ee83190b588c0b8116dd16d · Correção
• https://osv.dev/vulnerability/CVE-2026-25728 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25728 · Nota de Segurança
• https://t.me/cveNotify/152327 · Publicação no Telegram
• https://t.me/CVEtracker/44313 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2021378111539949667 · Publicação no Twitter