{"uuid": "7a1c2c41-5b1b-43d0-932f-e44c52594f32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108902", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422881703608371", "content": "CVE-2026-108902 pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108902https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be469d67ee75chttps://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/core/classes/PictureCore.php#L23-L38https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-file-deletion-via-picture-link#ph7software #ph7builder#CVE_2026_108902#bot", "creation_timestamp": "2026-10-11T15:03:03.593895Z"}