---
id: "CVE-2026-116263"
kind: "vulnerability"
aliases: ["CVE-2026-116263"]
title: "PictShare: race condition in file upload lets remote attackers interfere"
severity: "medium"
cvss: 4.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "pictshare", "self-hosted"]
not_affected_if: ["no-public-upload", "pictshare-3.7.2-or-later"]
published_at: "2026-10-26T12:17:07+00:00"
first_seen_at: "2026-10-26T12:29:53+00:00"
updated_at: "2026-10-26T12:31:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116263", "first_seen_at": "2026-10-26T12:29:53+00:00"}]
---

# PictShare: race condition in file upload lets remote attackers interfere

PictShare, a self-hosted image sharing application, has a race condition in the architect function of src/inc/core.php in its file upload component. A remote attacker can exploit the timing window, and the sources say a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PictShare version and see whether it is `3.7.1` or earlier
- Look at src/inc/core.php for the architect function and confirm whether the patched code is present
- unknown for any further check the sources do not describe

## Fix

- Upgrade PictShare to `3.7.2` or later (the sources cite patch 6306e33da630c04ddff60703922c2ec7b7539452)

## Timeline

- 2026-10-26T12:29:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116263

## From the sources

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_