The flaw is a race condition in the architect function of the file upload component. The issue allows a remote attacker to launch the race condition by manipulating file uploads, making the security control behave unpredictably. The attack is complex, requires high skill, but has been published and may be used. Exploitation could result in unauthorized file handling or file overwrite, compromising integrity and possibly confidentiality of the hosted photos.

HaschekSolutions PictShare versions up to and including 3.7.1 are affected. The vendor released a patch in version 3.7.2 that removes the race condition from src/inc/core.php.

The vulnerability has a low CVSS score of 2.1, indicating minimal damage if successfully exploited. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting a low likelihood of mass exploitation. The attack vector is remote, targeting the file upload endpoint, and the difficulty of exploitation is rated high, so the overall risk to a system is low.