PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the publicly visible file hash to retrieve the deletecode via the info API and then invoke the delete API to permanently delete arbitrary files, while also exposing uploader IP, User Agent, remote port, and SHA-1 hash, resulting in loss of content integrity, availability, and uploader privacy.

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the deletecode authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid deletecode values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.