CVE-2026-104356
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Risk Assessment
The risk includes unauthorized deletion of hosted files, potentially leading to data loss, service integrity compromise, and harm to users.
Recommendation
It is recommended to update PictShare to version 3.7.1 or later and replace the token generator with a cryptographically secure one (e.g., random_bytes). Also consider additional authorization mechanisms for deletion operations.
Other vulnerabilities in PictShare
See all- CVE-2026-116263Medium
A flaw was found in HaschekSolutions PictShare up to 3.7.1 in the architect function of src/inc/core.php within the File Upload component. The manipulation causes a race condition, and the attack can be initiated remotely. Attack complexity is rated high and exploitability difficult; the exploit has been published and may be used.
- CVE-2026-104051High
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint, which returns the complete raw metadata object without a field whitelist.
Original NVD description (English source)
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS