CVE-2026-108902: pH7Builder Path Traversal File Deletion

CVE ID	CVE-2026-108902
Severity	HIGH — CVSS CVSS V3.1 8.1
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE	CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Produk	ph7software / ph7builder — 0 (affected), 18.5.0 (unaffected)
Dipublikasikan	2026-10-11

Ringkasan Cepat

• CVE-2026-108902 adalah path traversal CWE-22 pada pH7Builder sebelum 18.5.0.
• Anggota terautentikasi dapat menghapus file arbitrer melalui parameter POST picture_link, termasuk foto, konfigurasi, dan cache.
• Dampaknya adalah kehilangan konten dan denial of service; versi 18.5.0 tercatat sebagai unaffected.

Ringkasan Kerentanan

pH7Builder (pH7 Social Dating CMS) sebelum 18.5.0 memiliki kerentanan path traversal pada modul picture, tepatnya action deletePhoto(). Deskripsi resmi menyebutkan bahwa anggota terautentikasi dapat menghapus file arbitrer dengan menyuplai urutan ../ pada parameter POST picture_link.

Kerentanan ini terdaftar sebagai CVE-2026-108902 dengan CWE-22 Improper Limitation of a Pathname to a Restricted Directory, atau path traversal. Publikasi CVE tercatat pada 2026-10-11T14:58:04.894Z.

Dampak Teknis

Severity resmi adalah HIGH dengan skor CVSS V3.1 8.1 dan vektor CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Artinya, serangan dapat dilakukan melalui jaringan, kompleksitas rendah, memerlukan hak akses rendah, dan tanpa interaksi pengguna.

Dalam vektor tersebut, dampak kerahasiaan dicatat tidak ada (C:N), sedangkan integritas tinggi (I:H) dan ketersediaan tinggi (A:H). File yang dapat terdampak menurut deskripsi mencakup foto anggota lain serta file konfigurasi dan cache, sehingga berpotensi menyebabkan kehilangan konten dan denial of service.

Produk Terdampak

Produk yang terdampak adalah ph7builder dari vendor ph7software. Data produk CNA mencatat versi 0 sebagai affected dan versi 18.5.0 sebagai unaffected. Judul CNA menyebut pH7Builder before 18.5.0, sehingga organisasi yang masih menjalankan versi sebelum 18.5.0 perlu waspada.

Referensi perbaikan mencakup commit GitHub 2ffa19ac36d58dbaac37e1c4912be469d67ee75c, berkas PictureCore.php pada repositori pH7-Social-Dating-CMS, dan advisory VulnCheck di https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-file-deletion-via-picture-link.

Konteks Pertahanan

Kerentanan ini menekankan pentingnya validasi path dan pembatasan operasi file pada aplikasi web. Parameter yang mengarah ke operasi hapus file harus dipastikan hanya merujuk ke direktori yang diizinkan dan tidak dapat keluar dari direktori tersebut.

Dari sudut pandang pertahanan, administrator pH7Builder perlu memantau log aktivitas anggota, terutama permintaan ke action deletePhoto, serta menjaga backup foto, konfigurasi, dan cache. Pembaruan ke versi 18.5.0 menjadi langkah utama karena versi tersebut tercatat sebagai unaffected.

Mitigasi dan Perbaikan

• Perbarui pH7Builder ke versi 18.5.0 atau lebih baru, karena versi 18.5.0 tercatat sebagai unaffected.
• Jika pembaruan penuh belum memungkinkan, terapkan patch dari commit GitHub yang direferensikan: https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be469d67ee75c.
• Batasi dan audit hak anggota yang dapat mengakses fitur hapus foto; pastikan hanya peran yang membutuhkan yang memiliki izin.
• Validasi dan normalisasi parameter picture_link, termasuk menolak urutan path traversal dan membatasi operasi file pada direktori unggahan yang diizinkan.
• Cadangkan secara berkala file konfigurasi, cache, dan foto, serta pantau log untuk aktivitas penghapusan file yang tidak wajar.

Referensi Resmi

• CVE-2026-108902 — CVE Program (cve.org)
• https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be469d67ee75c
• https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/core/classes/PictureCore.php#L23-L38
• https://github.com/pH7Software/pH7-Social-Dating-CMS
• https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-file-deletion-via-picture-link

Artikel ini disusun dari data publik CVE Program (cve.org). Selalu verifikasi patch resmi dari vendor sebelum menerapkan perubahan.

Pertanyaan yang Sering Diajukan (FAQ)

Apa itu CVE-2026-108902?

CVE-2026-108902 adalah kerentanan path traversal CWE-22 pada pH7Builder sebelum 18.5.0. Kerentanan berada di modul picture, action deletePhoto(), dan memungkinkan anggota terautentikasi menghapus file arbitrer melalui parameter POST picture_link.

Siapa yang dapat memicu kerentanan ini?

Berdasarkan deskripsi resmi dan vektor CVSS PR:L, pihak yang dapat memicunya adalah anggota terautentikasi. Vektor juga mencatat UI:N, sehingga tidak diperlukan interaksi pengguna lain.

File apa yang berpotensi terhapus?

Deskripsi resmi menyebut foto anggota lain serta file konfigurasi dan cache. Dampaknya dapat berupa kehilangan konten dan denial of service.

Seberapa serius kerentanan ini?

Severity resminya HIGH 8.1 dengan vektor CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Dampak integritas dan ketersediaan dinilai tinggi, sedangkan kerahasiaan tidak terdampak menurut vektor tersebut.

Apakah sudah ada perbaikan?

Ya. Versi 18.5.0 tercatat sebagai unaffected, dan tersedia referensi commit perbaikan di GitHub. Pengguna disarankan memperbarui ke versi 18.5.0 atau lebih baru.

Apa langkah mitigasi jika belum bisa memperbarui?

Terapkan patch yang direferensikan, batasi hak akses fitur hapus foto, validasi parameter picture_link, cadangkan file penting, dan pantau log aktivitas penghapusan file.

English Version — CVE-2026-108902: pH7Builder Path Traversal File Deletion

Quick Summary

• CVE-2026-108902 is a CWE-22 path traversal vulnerability in pH7Builder before 18.5.0.
• Authenticated members can delete arbitrary files via the picture_link POST parameter, including photos, configuration, and cache.
• The impact is content loss and denial of service; version 18.5.0 is listed as unaffected.

Vulnerability Summary

pH7Builder (pH7 Social Dating CMS) before 18.5.0 has a path traversal vulnerability in the picture module, specifically the deletePhoto() action. The official description states that an authenticated member can delete arbitrary files by supplying a ../ sequence in the picture_link POST parameter.

This vulnerability is registered as CVE-2026-108902 with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, or path traversal. The CVE was published on 2026-10-11T14:58:04.894Z.

Technical Impact

The official severity is HIGH with a CVSS V3.1 score of 8.1 and vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. This means the attack can be carried out over the network, has low complexity, requires low privileges, and involves no user interaction.

In that vector, the confidentiality impact is recorded as none (C:N), while integrity is high (I:H) and availability is high (A:H). According to the description, files that may be affected include other members' photos as well as configuration and cache files, potentially causing content loss and denial of service.

Affected Products

The affected product is ph7builder from vendor ph7software. CNA product data lists version 0 as affected and version 18.5.0 as unaffected. The CNA title states pH7Builder before 18.5.0, so organizations still running versions before 18.5.0 should be alert.

Fix references include GitHub commit 2ffa19ac36d58dbaac37e1c4912be469d67ee75c, the file PictureCore.php in the pH7-Social-Dating-CMS repository, and the VulnCheck advisory at https://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-file-deletion-via-picture-link.

Defense Context

This vulnerability highlights the importance of path validation and restricting file operations in web applications. Parameters used in file deletion operations must be guaranteed to reference only permitted directories and must not be able to escape them.

From a defense perspective, pH7Builder administrators should monitor member activity logs, especially requests to the deletePhoto action, and maintain backups of photos, configuration, and cache. Updating to version 18.5.0 is the primary step because that version is listed as unaffected.

Mitigation

• Update pH7Builder to version 18.5.0 or later, because version 18.5.0 is listed as unaffected.
• If a full update is not yet possible, apply the patch from the referenced GitHub commit: https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be469d67ee75c.
• Restrict and audit member privileges that can access the photo deletion feature; ensure only roles that require it have permission.
• Validate and normalize the picture_link parameter, including rejecting path traversal sequences and restricting file operations to permitted upload directories.
• Regularly back up configuration, cache, and photo files, and monitor logs for unusual file deletion activity.

FAQ (English)

What is CVE-2026-108902?

CVE-2026-108902 is a CWE-22 path traversal vulnerability in pH7Builder before 18.5.0. The vulnerability is in the picture module, the deletePhoto() action, and allows authenticated members to delete arbitrary files via the picture_link POST parameter.

Who can trigger this vulnerability?

Based on the official description and CVSS vector PR:L, it can be triggered by an authenticated member. The vector also lists UI:N, so no interaction from another user is required.

What files could potentially be deleted?

The official description mentions other members' photos as well as configuration and cache files. The impact can include content loss and denial of service.

How serious is this vulnerability?

Its official severity is HIGH 8.1 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The integrity and availability impacts are rated high, while confidentiality is not affected according to that vector.

Is a fix available?

Yes. Version 18.5.0 is listed as unaffected, and a reference to the fix commit is available on GitHub. Users are advised to update to version 18.5.0 or later.

What are the mitigation steps if updating is not yet possible?

Apply the referenced patch, restrict access rights to the photo deletion feature, validate the picture_link parameter, back up important files, and monitor logs for file deletion activity.