CVE-2026-108902: pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picturelink parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pH7Builderto a version that resolves this vulnerability.Fixed in 18.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated pH7Builder member can exploit it. No user interaction is required, and the attack can be performed remotely by submitting a crafted POST request.
Which deployments are affected?
pH7Builder versions before 18.5.0 are affected. The vulnerable functionality is in the picture module's deletePhoto() action.
What access does an attacker need?
The attacker needs a valid member account and the ability to submit a value for the picture_link POST parameter. They can use ../ path traversal sequences in that parameter.
What could an attacker delete?
The issue can be used to delete other members' photos as well as configuration and cache files. This can cause content loss and denial of service.
What should be done if patching cannot happen immediately?
Restrict access to untrusted member accounts where possible and monitor requests to the picture deletion functionality for picture_link values containing ../ sequences.