Alisher Qarshibayev

**Name of the Vulnerable Software and Affected Versions** PictShare versions prior to 3.7.1 **Description** An information disclosure issue exists where unauthenticated attackers can obtain the secret `delete code` and uploader metadata. This occurs when calling the 'API::info()' endpoint, which returns the complete raw metadata object without a field whitelist. By using a publicly visible file hash, an attacker can retrieve the `delete code` and subsequently use the delete API to permanently remove arbitrary files. Additionally, this exposes the uploader IP, User Agent, remote port, and SHA-1 hash, compromising content integrity, availability, and uploader privacy. **Recommendations** Update PictShare to version 3.7.1 or later. Restrict access to the 'API::info()' endpoint to minimize the risk of metadata exposure.

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.

**Name of the Vulnerable Software and Affected Versions** Laranode versions prior to 1.2.1 **Description** Authenticated users can perform a path traversal attack via the 'POST /filemanager/upload-file' endpoint. By providing directory traversal sequences in the `path` parameter, an attacker can write arbitrary files, such as PHP files, outside their designated home directory and into the web roots of other tenants, leading to remote code execution within those tenants' contexts. **Recommendations** Update Laranode to version 1.2.1 or later. As a temporary mitigation, restrict access to the 'POST /filemanager/upload-file' endpoint or avoid using the `path` parameter until the update is applied.