CVE-2026-104356
PictShare < 3.7.1 Predictable Delete Code via rand()
HaschekSolutions pictshare
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.7.1pictshareCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Text from CVE List
Affected versions 1
- pictshareaffected: 2.0.0 before 3.7.1CVE List