Threats affecting pkg:github/hascheksolutions/pictshare

CVE-2026-116263 is a race condition vulnerability in HaschekSolutions PictShare versions 3.7.0 and 3.7.1, specifically in the function architect within src/inc/core.php related to file upload handling. The flaw can be exploited remotely but requires high attack complexity and is difficult to exploit. A public exploit exists. Upgrading to version 3.7.2 resolves the issue.

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.

PictShare versions before 3.7.1 have an information disclosure vulnerability in the API::info() endpoint that allows unauthenticated attackers to access sensitive metadata including the secret delete_code and uploader details. This enables attackers to delete arbitrary files and exposes uploader IP, User Agent, remote port, and file hash, compromising content integrity, availability, and uploader privacy.