cve: POSTCUT-002
alias: Upload validator TOCTOU — image swap between validate and move
cwe_primary: CWE-367
cwe_acceptable: [CWE-367, CWE-362, CWE-22, CWE-434]
target_file: source.py
vuln_lines: [25, 26, 34, 35, 36, 37]
severity: high
vuln_class: toctou_race
exploit_pattern_regex: '(toctou|race\s*condition|time[- ]of[- ]check|swap|replace.*file|symlink|inotify)'
must_mention_any:
  - toctou
  - race condition
  - time-of-check
  - validate then move
  - swap file
  - symlink
  - between validation
  - between check
  - attacker replaces
points: 30
memorization_resistant: true
notes: |
  Synthetic — novel pattern. Validate then move pattern with no atomic
  handle: attacker can replace the file at tmp_path between validate_image()
  (passes — real image) and shutil.move() (now moves the attacker's payload
  e.g. a PHP shell). Symlink swap or inotify-timed replacement works.
  X-Sendfile note hints that arbitrary content gets served regardless of
  extension — broader impact.