CVE-2026-104356

22th percentile - higher than 22% of all known CVEs

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.

The risk includes unauthorized deletion of hosted files, potentially leading to data loss, service integrity compromise, and harm to users.

It is recommended to update PictShare to version 3.7.1 or later and replace the token generator with a cryptographically secure one (e.g., random_bytes). Also consider additional authorization mechanisms for deletion operations.