CVE-2026-104356

Name of the Vulnerable Software and Affected Versions PictShare versions prior to 3.7.1

Description The software contains a weak randomness issue where the getRandomString() function utilizes the non-cryptographic rand() Pseudo-Random Number Generator (PRNG) to create the delete code authorization token within the src/inc/core.php file. This allows attackers to predict or infer the PRNG state to guess valid delete code values, enabling the unauthorized deletion of hosted files without requiring access to the info endpoint.

Recommendations Update to version 3.7.1 or later. As a temporary mitigation, restrict access to the getRandomString() function or the file deletion functionality until the update is applied.