CVE-2026-108902 | pH7Software pH7Builder up to 18.4.x Picture deletePhoto picture_link path traversal

October 11, 2026 Yanac

A vulnerability classified as problematic has been found in pH7Software pH7Builder up to 18.4.x. Affected is the function deletePhoto of the component Picture Module. The manipulation of the argument picture_link leads to path traversal.

This vulnerability is listed as CVE-2026-108902. The attack may be initiated remotely. There is no available exploit.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More