---
id: CVE-2026-116263
title: HaschekSolutions PictShare File Upload core.php architect race condition
summary: >-
  A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted
  element is the function architect of the file src/inc/core.php of the
  component File Upload. This manipulation causes race condition. The attack can
  be initiat…
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-362
vendor: HaschekSolutions
product: PictShare
affected:
  - PictShare 3.7.0
  - PictShare 3.7.1
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T12:00:25.689Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116263'
references:
  - url: 'https://vuldb.com/vuln/426302'
    label: >-
      VDB-426302 | HaschekSolutions PictShare File Upload core.php architect
      race condition
  - url: 'https://vuldb.com/vuln/426302/cti'
    label: 'VDB-426302 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116263'
    label: CVE-2026-116263 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1010844'
    label: 'Submit #1010844 | HaschekSolutions PictShare 3.7.1 Race Condition'
  - url: 'https://xmit.xyz/security/the-file-that-changed-its-mind/'
  - url: >-
      https://github.com/HaschekSolutions/pictshare/commit/6306e33da630c04ddff60703922c2ec7b7539452
  - url: 'https://github.com/HaschekSolutions/pictshare/releases/tag/v3.7.2'
  - url: 'https://github.com/HaschekSolutions/pictshare/'
tags:
  - cve.org
ingestedAt: '2026-10-26T12:26:18.478Z'
---

## Overview

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.

## Affected

- `PictShare 3.7.0`
- `PictShare 3.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.