{"id":"CVE-2026-116263","kind":"vulnerability","aliases":["CVE-2026-116263"],"related":[],"title":"PictShare: race condition in file upload lets remote attackers interfere","description":"A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.","summary":"PictShare, a self-hosted image sharing application, has a race condition in the architect function of src/inc/core.php in its file upload component. A remote attacker can exploit the timing window, and the sources say a public exploit exists.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","pictshare","self-hosted"],"not_affected_if":["no-public-upload","pictshare-3.7.2-or-later"],"how_to_check":"- Check the installed PictShare version and see whether it is `3.7.1` or earlier\n- Look at src/inc/core.php for the architect function and confirm whether the patched code is present\n- unknown for any further check the sources do not describe","fix":"- Upgrade PictShare to `3.7.2` or later (the sources cite patch 6306e33da630c04ddff60703922c2ec7b7539452)","status":"open","published_at":"2026-10-26T12:17:07+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","triaged_at":"2026-10-26T12:31:45+00:00","updated_at":"2026-10-26T12:31:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T12:31:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PictShare to `3.7.2` or later (the sources cite patch 6306e33da630c04ddff60703922c2ec7b7539452)","reach":"internet","title":"PictShare: race condition in file upload lets remote attackers interfere","impact":"medium","summary":"PictShare, a self-hosted image sharing application, has a race condition in the architect function of src/inc/core.php in its file upload component. A remote attacker can exploit the timing window, and the sources say a public exploit exists.","category":"package","nicknames":[],"who_cares":["pictshare","self-hosted","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown exact impact; race condition in file upload handling","analyst_note":"Sources do not state the exact effect of the race condition or whether authentication is needed; check the NVD entry and the upstream commit 6306e33da630c04ddff60703922c2ec7b7539452 for the impact.","how_to_check":"- Check the installed PictShare version and see whether it is `3.7.1` or earlier\n- Look at src/inc/core.php for the architect function and confirm whether the patched code is present\n- unknown for any further check the sources do not describe","needs_analyst":true,"not_affected_if":["pictshare-3.7.2-or-later","no-public-upload"],"who_is_affected":"Teams running PictShare 3.7.1 or earlier that accept file uploads from the internet or untrusted users are exposed. Installations on a private network without untrusted uploads, or ones already on 3.7.2, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3416,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116263':13A,16A '-2026':12A,15A '3.7.1':72C '3.7.2':126C '6306e33':135C 'advis':139C 'affect':143C 'applic':30B 'architect':37B,79C 'attack':9A,48B,95C,101C 'caus':91C 'complex':103C 'compon':45B,86C,144C 'condit':3A,34B,93C 'contact':148C 'cve':11A,14A 'da630c04ddff60703922c2ec7b7539452':136C 'difficult':113C 'disclosur':152C 'earli':149C 'element':75C 'exist':61B 'exploit':50B,60B,109C,115C 'file':5A,43B,82C,87C 'flaw':63C 'found':66C 'function':38B,78C 'hascheksolut':68C 'high':107C 'host':22B,27B 'imag':28B 'impact':74C 'initi':98C 'interfer':10A 'issu':132C 'let':7A 'manipul':90C 'may':120C 'name':134C 'packag':17B 'patch':133C 'php':18B 'pictshar':1A,19B,23B,69C 'public':59B 'publish':118C 'race':2A,33B,92C 'rate':105C 'regard':111C 'remot':8A,47B,99C 'resolv':130C 'say':57B 'self':21B,26B 'self-host':20B,25B 'share':29B 'sourc':56B 'src/inc/core.php':40B,83C 'suffici':128C 'time':52B 'upgrad':123C,141C 'upload':6A,44B,88C 'use':122C 'vendor':146C 'version':125C 'window':53B","nicknames":[],"mitigations":[],"who_affected":"Teams running PictShare 3.7.1 or earlier that accept file uploads from the internet or untrusted users are exposed. Installations on a private network without untrusted uploads, or ones already on 3.7.2, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T12:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116263","severity":null,"published_at":"2026-10-26T12:17:07+00:00","modified_at":"2026-10-26T12:17:07+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","fetched_at":"2026-10-26T12:29:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}