pH7Builder CVE-2026-108902

Exploitation requires an authenticated member account (CVSS PR:L) on the target pH7Builder instance and access to the picture module's deletePhoto() action; the attacker must place ../ traversal sequences in the POST picture_link parameter, which is concatenated unsanitized into PH7_PATH_PUBLIC_DATA_SYS_MOD.'picture/img/...'. Limiting factors: the account prerequisite means instances that disable open member self-registration significantly raise the bar; exploitation is confined to file deletion (no read/exfiltration and no code execution), and all affected versions are before 18.5.0 - the fix rejects any picture_link whose basename differs from the raw input, neutralizing traversal.

This is a real but moderate-priority issue, best characterized as a destructive integrity/availability flaw rather than a code-execution threat. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.2 and is internally consistent with the description: network-reachable, low-complexity, and requiring only low-privilege authentication (PR:L) - i.e. any registered member of the dating site. Impact is correctly scoped to VI:H/VA:H with VC:N, meaning attackers can destroy/overwrite file state and cause denial of service but cannot read data, so this is NOT a confidentiality breach. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence; per precision rules this means 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The GitHub commit (2ffa19a) is the vendor fix and confirms the root cause and remediation, but its presence should not be mistaken for an exploitation signal. The key real-world limiter is the authentication requirement - exploitation presupposes a valid member account on the target instance - which, combined with the product's niche footprint, argues for prioritized patching only on internet-facing pH7Builder deployments that allow open member registration rather than emergency treatment.

An attacker registers or uses an existing low-privilege member account on a pH7Builder dating site and invokes the picture module's deletePhoto() action, submitting a POST request whose picture_link parameter contains ../ sequences. Because the parameter is concatenated into a filesystem path without validation, the attacker deletes other members' photos or the application's configuration and cache files, corrupting the site and causing denial of service. No public exploit code was identified, but the fix commit publicly reveals the vulnerable code path, lowering the barrier to weaponization.