PictShare CVE-2026-104356

Exploitation requires that the target PictShare instance run a version before 3.7.1 where getRandomString() in src/inc/core.php builds the delete_code from the non-cryptographic rand() PRNG. The attacker must know the target file's hash (exposed in public PictShare URLs) and must infer or recover the rand() PRNG state well enough to reproduce the generated delete_code - this PRNG-prediction requirement is the HIGH attack-complexity (AC:H) limiter and is the main factor constraining real-world exploitation. No authentication (PR:N) and no user interaction (UI:N) are needed against default configurations. Impact is limited to unauthorized file deletion (availability); it does not grant data disclosure. Instances on 3.7.1+ (using random_int()) are not affected, and the pre-patch info endpoint exposure of delete_code is a separate, now-fixed leakage path.

This is a genuine but bounded-impact authorization weakness, not a top-tier emergency. The only provided scoring signal is the vendor/NVD CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, base 8.2), which shows network, unauthenticated, no-user-interaction exploitation but HIGH attack complexity, and impact limited strictly to availability (VA:H) - specifically unauthorized deletion of hosted files, with zero confidentiality or integrity impact (VC:N/VI:N). No EPSS score, no CISA KEV entry, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The elevated 8.2 is driven mainly by the 4.0 scoring model's treatment of unauthenticated network access against a high-value impact, but the AC:H metric is doing important work here: successful exploitation requires actually predicting or recovering the PHP rand() PRNG state, which is non-trivial and server-state-dependent. Net: this is a real, patch-worthy authorization flaw (predictable delete_code lets an attacker bypass the delete token), but given a niche self-hosted product, availability-only impact, high complexity, and no exploitation/POC signals, it is a moderate priority rather than a drop-everything issue. Note the scoring covers only file deletion; the same patch also hardened the info endpoint that previously leaked the delete_code, which is a related but separately-scored exposure.

An attacker who knows the public hash of a hosted file (hashes appear in PictShare URLs) analyzes the server's weak rand()-based token generation to predict the delete_code tied to that file, then submits a delete request with the guessed code to destroy the file without ever reading the code from the info endpoint. Because the PRNG is seeded and advanced predictably, an attacker able to observe or infer PRNG state can forge valid delete tokens for arbitrary hosted files. No public POC was provided, and the HIGH attack complexity reflects the effort needed to recover the PRNG state.