Is CVE-2026-108902 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108902?

CVE-2026-108902 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-108902

Description

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.