Description
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HaschekSolutions | pictshare | 2.0.0 – < 3.7.1 | 3.7.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
wvllxe/CVE-2026-104356-pictshare-weak-delete-code ★ 2 · Oct 2, 2026
Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Patch Commit issue-tracking release-notes patch
- pictshare 3.7.1 Release Notes patch release-notes
- VulnCheck Advisory third-party-advisory