Race Condition in PictShare File Upload

Executive Summary

CVE-2026-116263 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in PictShare versions up to 3.7.1. It allows attackers with upload permissions to bypass file type and security checks by exploiting a race condition during file uploads. The flaw occurs because temporary filenames are predictable, enabling attackers to replace legitimate files with malicious ones before validation completes.

Useful 0 Not Useful 0

Detection Guidance

Detecting this TOCTOU vulnerability requires monitoring file upload processes and temporary file handling in PictShare versions 3.0.0 to 3.7.1. Check for predictable temporary filenames like md5(rand().time()) or URL basenames in /tmp or upload directories. Monitor for rapid file replacements during uploads and failed validation attempts. Use commands like 'find /path/to/pictshare/tmp -type f -name "*.tmp" -o -name "url_*"' to inspect temporary files. Logs showing repeated upload attempts with slight delays may indicate exploitation attempts.

Upgrade to version 3.7.2 or later to resolve the issue, as it introduces unpredictable temporary filenames with 128-bit hexadecimal suffixes (e.g., url_<128 random bits>). Verify the fix by checking temporary file naming patterns post-upgrade.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to upload unauthorized or malicious files to your PictShare instance. If exploited, it may enable hosting of illicit content, bypass security checks like mime type validation, and potentially mix files between users. The impact depends on the attacker's goals and the content they replace.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade PictShare to version 3.7.2 or later using the patch 6306e33da630c04ddff60703922c2ec7b7539452. This version introduces unpredictable temporary filenames and improved cleanup of rejected files. Ensure no users have upload permissions during the upgrade process to prevent exploitation.

Review and restrict file upload permissions to trusted users only. Monitor temporary directories for suspicious activity, such as rapid file replacements or failed validations. Consider disabling URL or base64 uploads temporarily if they are not critical to operations.

Useful 0 Not Useful 0