Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-116263: PictShare file upload can be hijacked remotely

CVE-2026-116263 · published 9 days ago

Summary

The file upload feature in PictShare versions up to 3.7.1 has a timing weakness that could let an attacker replace files with their own content. This can be triggered from outside the network and may allow malicious files to be placed on the server. Upgrade to PictShare 3.7.2 as soon as possible to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
hascheksolutions	pictshare	3.7.0

Original advisory text

HaschekSolutions PictShare File Upload core.php architect race condition

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.

References

https://vuldb.com/cve/CVE-2026-116263 Vendor Advisory
https://vuldb.com/submit/1010844 Vendor Advisory
https://vuldb.com/vuln/426302 Vendor Advisory
https://vuldb.com/vuln/426302/cti Third Party Advisory
https://github.com/HaschekSolutions/pictshare/commit/6306e33da630c04ddff60703922... Patch
https://xmit.xyz/security/the-file-that-changed-its-mind/ Exploit
https://github.com/HaschekSolutions/pictshare/ URL
https://github.com/HaschekSolutions/pictshare/releases/tag/v3.7.2 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1162... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-116263 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-362Race Condition

Timeline

Published26 Oct 2026

Updated31 Oct 2026

First seen26 Oct 2026

Sources

CVE-2026-116263 · NVD

CVE-2026-116263 · MITRE

CVE-2026-116263 · OSV

Track software like this

Free during beta