CVE-2026-25728 ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition

Critical 9.3 Published 10 Feb 2026 Updated 11 Feb 2026

Attackers can execute arbitrary PHP code by exploiting a race condition in ClipBucket's image upload process before validation occurs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-25728?

CVE-2026-25728 is a critical vulnerability in MacWarrior clipbucket-v5, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before validating them, creating a window where an attacker can execute arbitrary PHP code before the file is deleted. The uploaded file was moved to a web-accessible path via move_uploaded_file(), then validated via ValidateImage(). If validation failed, the file was deleted via @unlink(). This vulnerability is fixed in 5.5.3 - #40.

Weakness: CWE-367

Which versions are affected by CVE-2026-25728?

It affects 1 product.

Products include Oxygenz Clipbucket.

How do I fix CVE-2026-25728?

No fix has been published for CVE-2026-25728 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-25728 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25728 exists.

Sources

Also known as GHSA-xq7c-m5r2-9wqj.