Live › vulnerability › CVE-2026-116263
Go to dashboardPictShare, a self-hosted image sharing application, has a race condition in the architect function of src/inc/core.php in its file upload component. A remote attacker can exploit the timing window, and the sources say a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 12:29 UTC. All times on this page are UTC.
Teams running PictShare 3.7.1 or earlier that accept file uploads from the internet or untrusted users are exposed. Installations on a private network without untrusted uploads, or ones already on 3.7.2, can skip it.
No product ranges from the sources yet.
3.7.1 or earlier3.7.2 or later (the sources cite patch 6306e33da630c04ddff60703922c2ec7b7539452)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-116263")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.