Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-104051: PictShare allows anyone to view delete code and file info

CVE-2026-104051 · published 1 month ago

Summary

In versions before 3.7.1, PictShare’s public API reveals the secret delete code and details about who uploaded a file. Anyone can use this information to delete files or see uploader IP addresses and other metadata. Update to version 3.7.1 or later, or restrict access to the API, to stop the exposure.

What to do

Update hascheksolutions pictshare to version 3.7.1 or later.

Affected software

Vendor	Product	Affected versions
hascheksolutions	pictshare	< 3.7.1

Original advisory text

PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the publicly visible file hash to retrieve the delete_code via the info API and then invoke the delete API to permanently delete arbitrary files, while also exposing uploader IP, User Agent, remote port, and SHA-1 hash, resulting in loss of content integrity, availability, and uploader privacy.

References

https://www.vulncheck.com/advisories/pictshare-sensitive-information-disclosure-... Vendor Advisory
https://github.com/HaschekSolutions/pictshare/releases/tag/v3.7.1 Patch
https://github.com/HaschekSolutions/pictshare/commit/ce5fc474e89769efeae25fee763... Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-1040... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-104051 Vendor Advisory
https://github.com/HaschekSolutions/pictshare Product

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-522Insufficiently Protected Credentials

Timeline

Published1 Oct 2026

Updated4 Nov 2026

First seen1 Oct 2026

Sources

CVE-2026-104051 · NVD

CVE-2026-104051 · MITRE

CVE-2026-104051 · OSV

Track software like this

Free during beta