PictShare CVE-2026-104051

No special conditions beyond network reachability - remote unauthenticated exploitation works against default configurations of PictShare instances older than 3.7.1, since the unpatched API::info() endpoint returns the complete raw meta.json for any valid file hash with no authentication or configuration prerequisite. The only practical limiting factor is that the attacker must know or discover a file's hash; because hashes are publicly visible in share URLs, this is a weak barrier. Follow-on arbitrary deletion requires the disclosed delete_code, which the same unauthenticated info call provides, so the two conditions collapse into one. The fix also closes a related gap where an empty/falsy code could delete files lacking a stored delete_code (e.g. legacy files or the Docker MASTER_DELETE_CODE='' default), relevant to instances deployed with that default.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and base score of 8.8 indicate a network-reachable, low-complexity, unauthenticated flaw, which the source-code evidence fully corroborates: API::info() returned getMetadataOfHash() verbatim with no field whitelist, so any party knowing a file's publicly visible hash could read the secret delete_code and then call the delete API. This makes the primary real-world impact availability (VA:H - arbitrary permanent file deletion) plus limited confidentiality (VC:L - uploader IP, User Agent, remote port, SHA-1). There is no EPSS score, no CISA KEV listing, and no named proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; however, the fix is a public GitHub commit and VulnCheck advisory, both of which plainly describe the trivial exploit path (read hash → fetch delete_code → delete), so weaponization is low-effort even absent a published PoC. Net assessment: this is a genuine, actionable priority for anyone running an internet-exposed PictShare instance - not an inflated high-CVSS-but-low-real-risk issue - but it is bounded by the product's small deployment footprint, so it is unlikely to see widespread automated mass-exploitation. No conflicting signals were found between the CVSS vector and the description; both agree on network, unauthenticated access.

An unauthenticated attacker who has (or guesses/scrapes) the public hash of an uploaded file calls the info API endpoint, which returns the raw metadata object including the secret delete_code. The attacker then calls the delete API with that code to permanently remove arbitrary files, while also harvesting the uploader's IP address, User Agent, remote port, and SHA-1 hash. No public PoC is named in the data, but the public patch commit and VulnCheck advisory make the steps trivial to reproduce.