What is the CVSS score of CVE-2026-25728?

CVE-2026-25728 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-25728?

ClipBucket v5 contains a race condition vulnerability in image upload functionality that could allow attackers to bypass security controls and upload malicious files.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25728?

Yes, a public proof-of-concept exploit is available for CVE-2026-25728. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25728?

Within 24 hours: Identify all ClipBucket instances running versions prior to 5.5.3 and assess exposure in your environment. Within 7 days: Apply vendor patch to upgrade ClipBucket to version 5.5.3 or later across all affected systems. Within 30 days: Conduct security audit of avatar and background image uploads, review logs for suspicious file uploads during the vulnerability window, and validate patch deployment completion.

PHP CVE-2026-25728

HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-02-10 security-advisories@github.com

PHP Race Condition Clipbucket

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 18, 2026 - 15:02 vuln.today

Public exploit code

Patch released

Feb 18, 2026 - 15:02 nvd

Patch available

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before validating them, creating a window where an attacker can execute arbitrary PHP code before the file is deleted. The uploaded file was moved to a web-accessible path via move_uploaded_file(), then validated via ValidateImage(). If validation failed, the file was deleted via @unlink(). This vulnerability is fixed in 5.5.3 - #40.

AnalysisAI

Arbitrary PHP code execution in ClipBucket v5 prior to 5.5.3-#40 through a race condition in file upload validation, where files are moved to a web-accessible directory before security checks are performed. An authenticated attacker can exploit the time window between file placement and validation deletion to execute malicious PHP code on the server. Public exploit code exists for this vulnerability.

Technical ContextAI

Affects Clipbucket. ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before validating them, creating a window where an attacker can execute arbitrary PHP code before the file is deleted. The uploaded file was moved to a web-accessible path via move_uploaded_file(), then validated v