PT-2026-7321 · Unknown · Clipbucket

M0X41Nos · Published 2026-02-10 · Updated 2026-02-18 · CVE-2026-25728

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3

Description ClipBucket is an open source video sharing platform. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before validating them, allowing an attacker to potentially execute arbitrary PHP code before the file is deleted. The vulnerability occurs because the uploaded file is moved to a web-accessible path using the move uploaded file() function, then validated using ValidateImage(). If validation fails, the file is deleted using @unlink().

Recommendations Update to version 5.5.3 or later.

Exploit

Fix

RCE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-25728

GHSA-XQ7C-M5R2-9WQJ

Affected Products

Clipbucket

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25728.json · Exploit
• 🔥 https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-xq7c-m5r2-9wqj · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/09536e6e2ca6d69a2ee83190b588c0b8116dd16d · Patch
• https://osv.dev/vulnerability/CVE-2026-25728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25728 · Security Note
• https://t.me/cveNotify/152327 · Telegram Post
• https://t.me/CVEtracker/44313 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021378111539949667 · Twitter Post