PictShare: Predictable delete code due to weak randomness
Summary
PictShare before 3.7.1 generates the delete_code that authorizes deleting an uploaded file with the non-cryptographic rand() function. An attacker who can predict or infer the PRNG state can guess valid codes and delete hosted files without access to the code. The attack is remote and needs no authentication, but CVSS 4.0 rates the attack complexity as high.
Affected
- PictShare 2.0.0 up to but excluding 3.7.1 (CNA record)
- The exact list of affected releases between 3.3 and 3.7.0 is unconfirmed.
Fixed in
- PictShare 3.7.1 (commit ce5fc474e89769efeae25fee763894bcce3412e3 replaces rand() with random_int() and also fixes CVE-2026-104051)
Workaround
Unknown.
- If patching is not possible, restrict access to the instance to trusted networks (own suggestion, not vendor-documented).
Exploitation
- A public proof of concept by a third party exists (GitHub repository wvllxe).
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No evidence of exploitation in the wild was found.
Our recommendation
- Upgrade PictShare to 3.7.1 or later and check whether a newer release is available.
- Also address CVE-2026-104051 (delete code disclosure via the info API), which is fixed in the same release and is more directly exploitable.
- Check whether the instance is reachable from the internet and restrict access if it is not needed publicly.
- Monitor logs/deletes.log for unexpected deletions.
- Consider that files uploaded before the upgrade may still carry weak delete codes (unconfirmed by the vendor).
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
wvllxe/CVE-2026-104356-pictshare-weak-delete-code
Research sources
- Fix commit ce5fc47 (GitHub) github.com
- Release v3.7.1 (GitHub) github.com
- VulnCheck advisory: PictShare predictable delete code via rand() www.vulncheck.com
- VulDB CVE-2026-104356 vuldb.com
- OSV CVE-2026-104356 osv.dev
- Third-party PoC repository (wvllxe) github.com
- Related CVE-2026-104051 write-up (wvllxe) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:35.
Original description (NVD)
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.