Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-25728 is a critical-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Oxygenz Clipbucket. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
ClipBucket v5, an open source video sharing platform, contains a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability (CVE-2026-25728, CWE-367) in its avatar and background image upload functionality prior to version 5.5.3 - #40. The issue arises because the application uses move_uploaded_file() to relocate uploaded files to a web-accessible path before calling ValidateImage() for validation. If validation fails, the file is deleted via @unlink(), but this sequence creates a brief window of exposure.
A low-privileged remote user (PR:L) can exploit this vulnerability over the network (AV:N) by uploading a malicious file containing arbitrary PHP code disguised as an image. Due to the high attack complexity (AC:H) required to win the race condition, the attacker must access the web-accessible path during the narrow window before deletion, enabling execution of the PHP code. Successful exploitation grants high confidentiality, integrity, and availability impacts (CVSS 7.5: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is addressed in ClipBucket v5.5.3 - #40, as detailed in the GitHub security advisory (GHSA-xq7c-m5r2-9wqj) and the fixing commit (09536e6e2ca6d69a2ee83190b588c0b8116dd16d). Security practitioners should upgrade to the patched version to mitigate the race condition.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7051
Vulnerability Data
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to a web-accessible location…
more
before validating them, creating a window where an attacker can execute arbitrary PHP code before the file is deleted. The uploaded file was moved to a web-accessible path via move_uploaded_file(), then validated via ValidateImage(). If validation failed, the file was deleted via @unlink(). This vulnerability is fixed in 5.5.3 - #40.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.2V17.2.6
Mitigating Controls (NIST 800-53 r5) AI
A reference monitor that is always invoked and analyzable structurally eliminates the non-atomic check-then-use pattern underlying TOCTOU.
Access enforcement that performs an atomic check-and-use decision directly stops the window in which a TOCTOU race can be exploited.
Process isolation limits the blast radius of a successful TOCTOU exploitation but does not remove the race itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.