Low Severity
CVE-2026-104356
Published: Oct 25, 2026
Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.
# CVE-2026-104356 — Predictable `delete_code` via `rand()` in PictShare
> Authorized security research. PoC for defensive and educational use only.
[PictShare](https://github.com/HaschekSolutions/pictshare) generates the `delete_code`
authorization token with `getRandomString()`, which draws every character from PHP's
non-cryptographic `rand()`. Because `rand()` is not a CSPRNG — and the **same generator**
produces the public file hash shown in every shared URL — the `delete_code` is predictable
rather than secret, allowing unauthorized deletion of hosted files without ever reading the
code from the info endpoint.
| | |
|---|---|
| **CVE** | [CVE-2026-104356](https://www.cve.org/CVERecord?id=CVE-2026-104356) |
| **Product** | PictShare (self-hosted image/media host) |
| **Affected** | `>= 2.0.0`, `< 3.7.1` |
| **Fixed in** | [v3.7.1](https://github.com/HaschekSolutions/pictshare/releases/tag/v3.7.1) |
| **Vulnerability** | Use of Cryptographically Weak PRNG (CWE-338) → predictable auth token |
| **Privileges** | None (unauthenticated) |
| **CVSS 3.1** | 5.9 MEDIUM — `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` |
| **CVSS 4.0** | 8.2 HIGH — `AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H` |
| **Discovered by** | Alisher Qarshibayev |
| **Advisory** | [VulnCheck](https://www.vulncheck.com/advisories/pictshare-predictable-delete-code-via-rand) |
## Root Cause
```php
// src/inc/core.php (< 3.7.1)
function getRandomString($length=32, $keyspace='0123456789abcdefghijklmnopqrstuvwxyz')
{
$str = '';
$max = (function_exists('mb_strlen') ? mb_strlen($keyspace,'8bit') : strlen($keyspace)) - 1;
for ($i = 0; $i < $length; ++$i) {
$str .= $keyspace[rand(0, $max)]; // <-- rand() is NOT cryptogra