[CVE-2026-108902] pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the pict…

Descripción técnica

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.

Puntuación CVSS

Score: 8.1/10 — Severidad: HIGH — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Debilidades (CWE)

CWE-22

Fuente oficial

Publicado en NIST NVD.