CVE-2026-108902

EUVD-2026-97065
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.5%
Common Weakness Enumeration
References
https://github.com/pH7Software/pH7-Social-Dating-CMS
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/core/classes/PictureCore.php#L23-L38
https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be469d67ee75c
https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-file-deletion-via-picture-link