CVE-2026-119480

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.8

Description A Path Traversal issue exists due to missing ownership validation on attachment IDs provided via the media-field upload preset JSON. This allows authenticated users with subscriber-level access and above to reference attachments they did not upload. By supplying a manipulated attachment ID, an attacker can trigger the media cleanup routine to treat the file as a prior upload belonging to the current submission, resulting in the deletion of arbitrary media attachments.

Recommendations Update JetFormBuilder to version 3.6.8 or later.