# CVE-2026-108902: pH7Builder path traversal in picture module deletePhoto()

Source: https://junglewise.ai/threats/cve-2026-108902-ph7builder-ph7-social-dating-cms-before-18-5-0-contains-a-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108902 · Severity: high · CVSS 8.1 · Published 2026-10-11

pH7Builder is a self-hosted PHP platform for building dating and social networking sites. An authenticated member can exploit a path traversal vulnerability in the photo deletion feature to delete arbitrary files on the server, including other users' photos and system configuration files. This can result in data loss, account damage, and denial of service.

Technologies: [pH7Software pH7Builder](https://junglewise.ai/threats/technologies/ph7builder). Vendors: [pH7Software](https://junglewise.ai/threats/vendors/ph7software).

## Quick answers

**Is CVE-2026-108902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108902 being exploited in the wild.

**How severe is CVE-2026-108902?** High severity, with a CVSS score of 8.1, published 11 October 2026.

**Which products and versions are affected?** pH7Software pH7Builder before 18.5.0.

**Is there a fix for CVE-2026-108902?** Yes: fixed in 18.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108902 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108902?** Check whether you run pH7Software pH7Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 18.5.0

## Technical details

The deletePhoto() method in the picture module fails to sanitize the picture_link POST parameter before constructing file paths. An authenticated attacker can inject ../ sequences to traverse outside the intended directory and delete arbitrary files. The vulnerability requires authentication and direct manipulation of the picture_link parameter, and a fix is available in version 18.5.0.

## Affected products

- pH7Software pH7Builder before 18.5.0

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/pH7Software/pH7-Social-Dating-CMS](https://github.com/pH7Software/pH7-Social-Dating-CMS)
- [https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/core/classes/PictureCore.php](https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/core/classes/PictureCore.php)

## Related threats

- [pH7Builder hard-coded API key in Tool.class.php](https://junglewise.ai/threats/cve-2026-108905-ph7builder-ph7-social-dating-cms-before-18-6-0-contains-a-hard)
- [pH7Builder information disclosure in API user endpoints](https://junglewise.ai/threats/cve-2026-108904-ph7builder-ph7-social-dating-cms-before-18-5-0-contains-an)
- [pH7Builder CAPTCHA bypass in form validation](https://junglewise.ai/threats/cve-2026-108903-ph7builder-ph7-social-dating-cms-before-19-3-0-contains-a)
- [pH7Software pH7Builder IP spoofing authentication bypass](https://junglewise.ai/threats/cve-2026-37604-ph7software-ph7builder-ph7-social-dating-cms-through-18-2-0)
- [pH7Software pH7Builder authentication bypass in admin login](https://junglewise.ai/threats/cve-2026-37603-improper-restriction-of-excessive-authentication-attempts-in-the)