CVE-2026-108902

HIGH 8.1

pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.

CWE	CWE-22
Vendor	ph7software
Product	ph7builder
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for ph7software ph7builder

Be the first to know when new high vulnerabilities affecting ph7software ph7builder are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

ph7software / ph7builder

0 < 18.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be469d67ee75c github.com: https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/core/classes/PictureCore.php#L23-L38 github.com: https://github.com/pH7Software/pH7-Social-Dating-CMS vulncheck.com: https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-file-deletion-via-picture-link

Credits

Haluk Baran AKBULUT (CyberMap Group)