PictShare: Information disclosure via info API leads to unauthorized file deletion
Summary
PictShare before 3.7.1 returns the complete raw metadata of a file through the info API, without an unauthenticated access restriction or a field whitelist. The metadata includes the secret delete code, uploader IP address, user agent and remote port. An unauthenticated attacker who knows or obtains a file hash can retrieve the delete code and permanently delete the file, and can also learn uploader details.
Affected
- HaschekSolutions PictShare from 2.0.0 up to but not including 3.7.1 (per CVE record and OSV; VulDB states up to 3.7.0)
Fixed in
- Upgrade to PictShare 3.7.1 or later (vendor release v3.7.1 with fix commit ce5fc47)
Workaround
- No vendor-documented workaround known.
- Unverified: restrict or block access to the info API path at the reverse proxy or limit the instance to trusted networks. Test first, as this may break integrations.
Exploitation
- Public proof-of-concept exists.
- Attack requires no authentication and is simple to automate (CISA SSVC: automatable yes).
- No confirmed exploitation in the wild found; not verified against the CISA KEV catalogue.
Our recommendation
- Check whether any PictShare instance is reachable from the internet, for example via external scans or a search for the /api/info/ path.
- Upgrade affected instances to 3.7.1 or later as a priority. Also apply the fix for the related CVE-2026-104356 (weak delete codes), which is included in the same release.
- If patching is delayed, back up hosted content and review access logs for repeated info API calls followed by delete calls.
- Internal instances behind authentication have lower priority.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
wvllxe/CVE-2026-104051-pictshare-info-disclosure
Research sources
- Fix commit ce5fc47 (GitHub) github.com
- Release v3.7.1 (GitHub) github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-104051 osv.dev
- Public PoC write-up (wvllxe) github.com
- Related CVE-2026-104356 write-up (wvllxe) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:54.
Original description (NVD)
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the publicly visible file hash to retrieve the delete_code via the info API and then invoke the delete API to permanently delete arbitrary files, while also exposing uploader IP, User Agent, remote port, and SHA-1 hash, resulting in loss of content integrity, availability, and uploader privacy.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.