Threats tagged 'ghsa-cmhg-xxg9-x9x9'

pH7Builder versions prior to 18.5.0 contain a path traversal vulnerability in the picture module's deletePhoto() action. Authenticated users can exploit this flaw by supplying '../' sequences in the picture_link parameter to delete arbitrary files, including other users' photos and configuration or cache files. This can lead to content loss and denial of service.