HIGH 7.2 NVD
CVE-2026-108902
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated me
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.
References
- https://github.com/pH7Software/pH7-Social-Dating-CMS
- https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/co
- https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be4
- https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-fil
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-10-11 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.