Is CVE-2026-108902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108902 being exploited in the wild.

How severe is CVE-2026-108902?

High severity, with a CVSS score of 8.1, published 11 October 2026.

Which products and versions are affected?

pH7Software pH7Builder before 18.5.0.

Is there a fix for CVE-2026-108902?

Yes: fixed in 18.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108902 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108902?

Check whether you run pH7Software pH7Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108902: pH7Builder path traversal in picture module deletePhoto()

CVE-2026-108902 · Severity: high · CVSS 8.1 · Published 2026-10-11

pH7Builder is a self-hosted PHP platform for building dating and social networking sites. An authenticated member can exploit a path traversal vulnerability in the photo deletion feature to delete arbitrary files on the server, including other users' photos and system configuration files. This can result in data loss, account damage, and denial of service.

Technologies: pH7Software pH7Builder. Vendors: pH7Software.

Quick answers

Is CVE-2026-108902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108902 being exploited in the wild.
How severe is CVE-2026-108902?: High severity, with a CVSS score of 8.1, published 11 October 2026.
Which products and versions are affected?: pH7Software pH7Builder before 18.5.0.
Is there a fix for CVE-2026-108902?: Yes: fixed in 18.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108902 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108902?: Check whether you run pH7Software pH7Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 18.5.0

Technical details

The deletePhoto() method in the picture module fails to sanitize the picture_link POST parameter before constructing file paths. An authenticated attacker can inject ../ sequences to traverse outside the intended directory and delete arbitrary files. The vulnerability requires authentication and direct manipulation of the picture_link parameter, and a fix is available in version 18.5.0.

Affected products

pH7Software pH7Builder before 18.5.0

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.