CVE-2026-104356— PictShare < 3.7.1 Predictable Delete Code via rand()
Quick assessment
Affected
HaschekSolutions pictshare
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PictShare 版本低于 3.7.1 存在弱随机性漏洞。其中， 文件中的 函数使用非密码学安全的 伪随机数生成器（PRNG）来生成 授权令牌。攻击者可以预测或推断该 PRNG 的内部状态，从而猜测出有效的 值，并在无需从 info 端点读取代码的情况下，未经授权地删除托管文件。
Possible ATT&CK Techniques 1 AI
T1552 · Unsecured Credentials
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104356
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PictShare < 3.7.1 Predictable Delete Code via rand()
Source: CVE Program / CVE List V5
Vulnerability Description
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用具有密码学弱点缺陷的PRNG
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HaschekSolutions | pictshare | 2.0.0 ~ 3.7.1 | - |
|
II. Public POCs for CVE-2026-104356
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104356
请登录查看更多情报信息。
Other References for CVE-2026-104356 (3)
-
https://github.com/HaschekSolutions/pictshare/commit/ce5fc474e89769efeae25fee763894bcce3412e3 issue-tracking release-notes
-
https://www.vulncheck.com/advisories/pictshare-predictable-delete-code-via-rand third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-338
-
CVE-2026-53953
GetSimple CMS: Predictable Password Reset Password Allows Ad -
CVE-2026-9864
Fortra BoKS Server Agent adjoin machine-account password gen -
CVE-2026-79901
Predictable Active Directory service-account passwords in Bo -
CVE-2026-94456
Unauthenticated recovery of the Math.random() state behind O -
CVE-2026-94107
NivoCart through 2.4.0 Predictable Administrator Password Re
V. Comments for CVE-2026-104356
No comments yet