A time‑of‑check to time‑of‑use race condition in ClipBucket v5 allows an attacker to upload an avatar or background image that is moved to a web‑accessible directory before the file is validated. If the validation fails, the file is deleted, but the window created before deletion can be exploited to execute arbitrary PHP code, resulting in remote code execution on the server.

The vulnerability affects any ClipBucket v5 installation running a version earlier than 5.5.3. The fix is contained in commit 5.5.3 – #40, which enforces validation before the file becomes web‑accessible. The affected product is the open‑source ClipBucket v5 as identified by the CNA MacWarrior.

With a CVSS score of 9.3 the weakness represents a high severity REMOTE CODE EXECUTION. The EPSS score is below 1 %, indicating a low current exploitation probability, although the threat remains significant because the attack can be carried out from a standard upload form without elevated privileges. The vulnerability is not listed in the CISA KEV catalog, but the lack of a public exploit does not change the potential impact. Based on the description it is inferred that an attacker can upload a maliciously crafted image file through the avatar or background upload interface to trigger the race condition and gain code execution.