Low Severity
CVE-2026-104051
Published: Oct 25, 2026
Sensitive info disclosure via info API in PictShare < 3.7.1 (CWE-522). PoC + advisory writeup.
# CVE-2026-104051 — Sensitive Information Disclosure via `info` API in PictShare
> Authorized security research. PoC for defensive and educational use only.
The `/api/info/<hash>` endpoint of [PictShare](https://github.com/HaschekSolutions/pictshare)
returns the **complete raw metadata object** for any uploaded file — including the secret
`delete_code` that authorizes deletion, plus the uploader's IP, User-Agent, remote port and
SHA-1. An unauthenticated attacker who knows a file's (publicly visible) hash can read its
`delete_code` and then permanently delete arbitrary hosted files.
| | |
|---|---|
| **CVE** | [CVE-2026-104051](https://www.cve.org/CVERecord?id=CVE-2026-104051) |
| **Product** | PictShare (self-hosted image/media host) |
| **Affected** | `>= 2.0.0`, `< 3.7.1` |
| **Fixed in** | [v3.7.1](https://github.com/HaschekSolutions/pictshare/releases/tag/v3.7.1) |
| **Vulnerability** | Insufficiently Protected Credentials (CWE-522) → arbitrary file deletion + privacy loss |
| **Privileges** | None (unauthenticated) |
| **CVSS 3.1** | 8.2 HIGH — `AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H` |
| **CVSS 4.0** | 8.8 HIGH — `AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H` |
| **Discovered by** | Alisher Qarshibayev |
| **Advisory** | [VulnCheck](https://www.vulncheck.com/advisories/pictshare-sensitive-information-disclosure-via-info-api) |
## Root Cause
`API::info()` looks up the hash and returns `getMetadataOfHash()` **verbatim** — no field
whitelist:
```php
// src/inc/api.class.php (< 3.7.1)
public function info()
{
$hash = $this->url[1] ?? '';
if (!$hash) return ['status' => 'err', 'reason' => 'Missing hash'];
if (!isExistingHash($hash)) ret