VULNERABILITY INTELLIGENCE
CVE-2026-108902
CVSS score7.2 HIGH
CISA KEVNot currently listed
Published2026-10-11
Last modified2026-10-11
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Description
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.
Weakness classification
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')