PH7 Social Dating CMS (< 18.6.0)

Authenticated users can exploit a path traversal vulnerability in the pH7Builder picture module to delete arbitrary files on the server.