CVE-2026-116263

HaschekSolutions PictShare File Upload core.php architect race condition

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Description
A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.

Analysis

AI-generated

Technical impact

The flaw is a race condition in the architect function of the file upload component. The issue allows a remote attacker to launch the race condition by manipulating file uploads, making the security control behave unpredictably. The attack is complex, requires high skill, but has been published and may be used. Exploitation could result in unauthorized file handling or file overwrite, compromising integrity and possibly confidentiality of the hosted photos.

Affected Systems

HaschekSolutions PictShare versions up to and including 3.7.1 are affected. The vendor released a patch in version 3.7.2 that removes the race condition from src/inc/core.php.

Risk and Exploitability

The vulnerability has a low CVSS score of 2.1, indicating minimal damage if successfully exploited. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting a low likelihood of mass exploitation. The attack vector is remote, targeting the file upload endpoint, and the difficulty of exploitation is rated high, so the overall risk to a system is low.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to HaschekSolutions PictShare version 3.7.2 or later, which incorporates the fix commit 6306e33d.
  • If an upgrade cannot be performed immediately, restrict file upload permissions so that only authorized users can write to the upload directory, reducing the attack surface.
  • Configure logging and monitoring to alert on unexpected file changes or uploads in the upload directory, enabling early detection of race‑condition exploitation attempts.

Generated by OpenCVE AI on October 26, 2026 at 13:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.
Title HaschekSolutions PictShare File Upload core.php architect race condition
First Time appeared Hascheksolutions
Hascheksolutions pictshare
Weaknesses CWE-362
CPEs cpe:2.3:a:hascheksolutions:pictshare:*:*:*:*:*:*:*:*
Vendors & Products Hascheksolutions
Hascheksolutions pictshare
References
Metrics cvssV2_0

{'score': 4.6, 'vector': 'AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 31, 2026, 1:16 AM
Reserved
Oct 25, 2026, 5:55 PM

View source JSON

Updated
Oct 31, 2026, 1:15 AM

JSON

Status
Deferred
Published
Oct 26, 2026, 12:17 PM
Modified
Oct 31, 2026, 2:17 AM

View source JSON

No data.

Updated
Oct 26, 2026, 2:00 PM

JSON