CVE-2026-108902: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in ph7software ph7builder
Description
pH7Builder versions before 18.5.0 contain a path traversal vulnerability in the picture module's deletePhoto() action. Authenticated users can exploit this flaw by supplying '../' sequences in the picture_link parameter to delete arbitrary files, including other users' photos and critical configuration or cache files. This can lead to content loss and denial of service.
CVSS v4.0
Score 7.2high
Affected software
ph7software
ph7builder
pkg:github/ph7software/pH7-Social-Dating-CMSRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108902 is a path traversal vulnerability in pH7Builder (pH7 Social Dating CMS) affecting versions prior to 18.5.0. The issue exists in the deletePhoto() action of the picture module, where insufficient validation of the pathname allows authenticated members to delete arbitrary files by including '../' sequences in the POST parameter picture_link. This improper limitation of pathname enables attackers to remove files beyond their authorized scope, impacting other users' photos and system files.
Potential Impact
Exploitation allows authenticated users to delete arbitrary files, including other members' photos and configuration or cache files. This can cause content loss and denial of service conditions within the application.
Mitigation Recommendations
A fix is available in pH7Builder version 18.5.0. Users should upgrade to version 18.5.0 or later to remediate this vulnerability. No additional mitigation guidance is provided in the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-11T14:47:05.981Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acba5592cdf04f656dd4a65
Added to database: 10/11/2026, 15:03:53 UTC
Last enriched: 10/11/2026, 15:18:21 UTC
Last updated: 10/11/2026, 15:19:04 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.