CVE-2026-116263

HaschekSolutions PictShare File Upload core.php architect race condition

HaschekSolutions PictShare

Open in Threatline Record JSON

CVSS

2.1Low

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-116263 A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipuTelegram: CVE Notify, 26 Oct 2026

Description

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.

Text from CVE List

Affected versions 3

PictShareaffected: 3.7.0CVE List
PictShareaffected: 3.7.1CVE List
PictShareunaffected: 3.7.2CVE List