CVE-2026-104356: PictShare < 3.7.1 Predictable Delete Code via rand()
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PictShareto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Frequently Asked Questions
Which deployments are affected?
PictShare deployments running versions before 3.7.1 are affected. The issue concerns delete_code tokens generated for hosted files.
What does an attacker need to exploit this?
The attacker needs to predict or infer the state of the rand() pseudo-random number generator in order to guess a valid delete_code value. No privileges or user interaction are required according to the supplied vector.
What is the impact of a successful exploit?
An attacker who successfully guesses a valid delete_code can delete hosted files without authorization. The provided impact information indicates availability impact only, with no stated confidentiality or integrity impact.
How can this be remediated?
Upgrade PictShare to version 3.7.1 or later. Version 3.7.1 is identified as the release addressing the weak delete_code generation.