CVE-2026-104356 in PictShare
Summary
by MITRE • 10/02/2026
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in PictShare versions prior to 3.7.1 stems from a fundamental flaw in the implementation of its file management security mechanisms, specifically within the core authentication logic for destructive operations. The application utilizes a function named getRandomString() to generate delete_code tokens, which serve as authorization credentials required to permanently remove uploaded images or files from the server's storage. This design choice is critical because it acts as the primary gatekeeper preventing unauthorized users from executing deletion commands against resources they do not own. By relying on this token-based approach rather than session cookies or complex access control lists for every request, the system attempts to simplify user interaction while maintaining security boundaries around sensitive file operations.
The technical root cause of this vulnerability lies in the specific pseudo-random number generator (PRNG) algorithm selected by the developers for generating these tokens. Instead of employing a cryptographically secure random number generator such as /dev/urandom on Unix-like systems or CryptGenRandom on Windows, the implementation defaults to the standard C library function rand(). The rand() function is designed for general-purpose simulation and gaming applications where unpredictability is not a security requirement. It typically utilizes linear congruential generators which have well-documented mathematical weaknesses that make their output sequences predictable if sufficient state information can be observed or inferred. In this context, the delete_code tokens are generated using values derived from rand(), creating a deterministic sequence rather than an unpredictable one.
From an operational perspective, this weakness allows attackers to bypass authentication controls entirely for file deletion tasks. Because the PRNG is not cryptographically secure, an attacker who can observe previous token generations or understand the seeding mechanism of the application can predict future delete_code values with high accuracy. This capability effectively neutralizes the intended security control, allowing malicious actors to construct valid HTTP requests that include guessed authorization codes. Consequently, attackers do not need to exploit additional vulnerabilities such as cross-site scripting or information disclosure flaws to retrieve these tokens from server responses or API endpoints like the info endpoint. The ability to predict the token stream means that any user with knowledge of the application's timing and seeding behavior can arbitrarily delete files hosted on the vulnerable instance.
The impact of this vulnerability is severe, particularly for applications relying on PictShare as a backend image hosting solution. Unauthorized deletion leads directly to data loss and potential denial of service conditions where legitimate users are denied access to their stored media assets. In environments where these images contain sensitive personal information or proprietary business content, the destruction of files represents a significant integrity violation with potentially serious legal and reputational consequences for the organization operating the platform. Furthermore, because the attack does not require prior authentication or complex exploitation chains involving multiple vectors, it lowers the barrier to entry significantly, enabling even low-skilled threat actors to execute destructive actions against vulnerable deployments.
This vulnerability aligns closely with CWE-330, which classifies weaknesses related to the use of insufficiently random values in security-critical contexts. The failure to utilize a cryptographically strong source of randomness for generating access tokens is a classic example of this category. Additionally, from an offensive cybersecurity framework perspective, such behavior facilitates actions categorized under ATT&CK techniques involving resource hijacking or data destruction, specifically those that involve manipulating application logic through predictable identifiers rather than exploiting software bugs in the traditional sense. The predictability of the token generation process undermines the integrity guarantees provided by the authorization mechanism.
To mitigate this vulnerability and restore security posture, organizations running PictShare must upgrade to version 3.7.1 or later where the developers have replaced the insecure rand() function with a cryptographically secure alternative. For environments that cannot immediately patch due to compatibility constraints, temporary mitigations should focus on restricting network access to the application interface and implementing strict rate limiting to reduce the feasibility of brute-force prediction attacks based on observed token patterns. However, these are only compensatory controls; the definitive resolution requires updating the software stack to ensure that all security-sensitive random number generation relies on entropy sources approved for cryptographic use by industry standards such as NIST SP 800-90A recommendations for random bit generators.