{"vulnerability": "CVE-2026-108902", "sightings": [{"uuid": "7a1c2c41-5b1b-43d0-932f-e44c52594f32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108902", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422881703608371", "content": "CVE-2026-108902 pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108902https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be469d67ee75chttps://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/core/classes/PictureCore.php#L23-L38https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-file-deletion-via-picture-link#ph7software #ph7builder#CVE_2026_108902#bot", "creation_timestamp": "2026-10-11T15:03:03.593895Z"}, {"uuid": "69e36e57-2bf8-4b5a-a8c2-a81bffc31cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108902", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmpovrakq2a", "content": "\ud83d\udfe0 CVE-2026-108902 - High (8.1)\n\npH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the p...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108902/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-11T19:16:07.223775Z"}]}