CVE-2026-108902 — pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete a…
Published: 2026-10-11 · CVSS: 7.2 · CVSS 4.0
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7