CVE-2026-104356: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in HaschekSolutions pictshare
PictShare versions prior to 3.7.1 use a non-cryptographic pseudo-random number generator (PRNG) to create delete_code authorization tokens. This weak randomness allows attackers to predict or infer valid delete_code values, enabling unauthorized deletion of hosted files without accessing the code from the info endpoint.
AI Analysis
Technical Summary
CVE-2026-104356 identifies a vulnerability in HaschekSolutions' PictShare before version 3.7.1 where the getRandomString() function relies on the non-cryptographic rand() PRNG to generate delete_code tokens. Because rand() is predictable, attackers can guess valid tokens and delete files without authorization. This vulnerability affects all versions from 2.0.0 up to but not including 3.7.1.
Potential Impact
Attackers can perform unauthorized deletions of hosted files by predicting the delete_code authorization tokens. This compromises the integrity and availability of user-hosted content on affected PictShare instances.
Mitigation Recommendations
Upgrade PictShare to version 3.7.1 or later, where this vulnerability is fixed by replacing the weak PRNG with a cryptographically secure random number generator. No other mitigation guidance is provided.
CVE-2026-104356: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in HaschekSolutions pictshare
Description
PictShare versions prior to 3.7.1 use a non-cryptographic pseudo-random number generator (PRNG) to create delete_code authorization tokens. This weak randomness allows attackers to predict or infer valid delete_code values, enabling unauthorized deletion of hosted files without accessing the code from the info endpoint.
CVSS v4.0
Score 8.2high
Affected software
HaschekSolutions
pictshare
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104356 identifies a vulnerability in HaschekSolutions' PictShare before version 3.7.1 where the getRandomString() function relies on the non-cryptographic rand() PRNG to generate delete_code tokens. Because rand() is predictable, attackers can guess valid tokens and delete files without authorization. This vulnerability affects all versions from 2.0.0 up to but not including 3.7.1.
Potential Impact
Attackers can perform unauthorized deletions of hosted files by predicting the delete_code authorization tokens. This compromises the integrity and availability of user-hosted content on affected PictShare instances.
Mitigation Recommendations
Upgrade PictShare to version 3.7.1 or later, where this vulnerability is fixed by replacing the weak PRNG with a cryptographically secure random number generator. No other mitigation guidance is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-01T20:48:03.271Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abed4c9a43b0b3b89071d87
Added to database: 10/01/2026, 21:46:49 UTC
Last enriched: 10/01/2026, 22:01:15 UTC
Last updated: 10/02/2026, 03:49:04 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.