Skip to content
CVE-2026-104051: PictShare API Vulnerability Exposes User Data and File Deletion Risk

CVE-2026-104051: PictShare API Vulnerability Exposes User Data and File Deletion Risk

First seen 4 Oct 2026, 04:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 4, 2026 at 06:06 UTC
  • •CVE-2026-104051 allows unauthorized file deletion via exposed API metadata.
  • •Affected versions of PictShare are prior to 3.7.1; upgrade is critical.
  • •No active exploitation confirmed, but opportunistic attacks are plausible.

PictShare versions prior to 3.7.1 contain an information disclosure vulnerability (CVE-2026-104051) that allows unauthenticated attackers to access sensitive uploader metadata and the secret delete_code via the API::info() endpoint. This flaw enables attackers to delete arbitrary files using only the publicly visible file hash, risking content integrity and uploader privacy. The vulnerability affects self-hosted, internet-facing image-sharing services, particularly public upload portals. No has been confirmed, but the potential for opportunistic scanning exists. Users are urged to upgrade to version 3.7.1, which mitigates the issue by enforcing a strict field whitelist. The vulnerability was publicly disclosed on October 1, 2026, with the first proof-of-concept released shortly thereafter. Current exploitation urgency remains unconfirmed due to the lack of reports.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-01
CVE-2026-104051 published
CVE-2026-104051 was published, detailing a critical vulnerability in PictShare.
Redpacketsecurity
2026-10-01
CVE-2026-104356 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-02
First public PoC released
Proof-of-concept code for CVE-2026-104051 was made publicly available, demonstrating the vulnerability.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2026-104051 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

Which versions of PictShare are vulnerable?
PictShare versions prior to 3.7.1 are affected by CVE-2026-104051.
What should I do if I am using PictShare?
Upgrade to PictShare version 3.7.1 immediately to mitigate the vulnerability.
Is there any active exploitation of this vulnerability?
No active exploitation has been confirmed as of now, but the potential for opportunistic attacks exists.