CVE-2026-108902 ph7software CVE debrief

Who should care

System administrators and security teams responsible for pH7Builder installations should assess exposure and prioritize patching to version 18.5.0 or later. They should also verify file deletion functionality and monitor for suspicious activity to prevent potential content loss and denial of service. Additionally, they should review compensating controls for exposed systems and check relevant monitoring, detection, and logs for exposed assets that need to

Why it matters

CVE-2026-108902 is a high-severity vulnerability in pH7Builder before 18.5.0 that allows authenticated members to delete arbitrary files. System administrators and security teams should assess exposure, prioritize patching, and monitor for suspicious activity.

• Potential for content loss and denial of service
• Risk of unauthorized file deletion
• Need for verification of patch deployment
• Potential for exploitation by authenticated members

Technical summary

The pH7Builder before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action. This allows authenticated members to delete arbitrary files by supplying ../ sequences in the POST picture_link parameter, potentially leading to content loss and denial of service. The vulnerability has a CVSS score of 7.2 and is classified as HIGH severity. System administrators and security teams should assess exposure and prioritize patching to version 18.5.0 or later. They should also verify file deletion functionality and monitor for suspicious activity.

Defensive priority

High priority for patching and verification

Recommended defensive actions

• Patch pH7Builder to version 18.5.0 or later
• Verify file deletion functionality
• Monitor for suspicious file deletion activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the path traversal vulnerability in pH7Builder before 18.5.0. The vulnerability allows authenticated members to delete arbitrary files via the picture module deletePhoto() action.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.