# CVE-2026-109573: phpMyFAQ SQL injection in PdoMysql escape

Source: https://junglewise.ai/threats/cve-2026-109573-phpmyfaq-before-4-1-9-contains-an-sql-injection-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109573 · Severity: high · CVSS 8.1 · Published 2026-10-12

phpMyFAQ is a web-based FAQ management system. An unauthenticated attacker can inject SQL commands through the search feature when the database runs in NO_BACKSLASH_ESCAPES mode, allowing them to read sensitive credentials and configuration, modify data, or destroy database tables. This vulnerability affects the public-facing search endpoint and requires no authentication.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-109573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109573 being exploited in the wild.

**How severe is CVE-2026-109573?** High severity, with a CVSS score of 8.1, published 12 October 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ before 4.1.9.

**Is there a fix for CVE-2026-109573?** Yes: fixed in phpMyFAQ 4.1.9. Until then: Ensure MySQL or MariaDB is not configured with NO_BACKSLASH_ESCAPES mode, or restrict network access to the phpMyFAQ api/autocomplete endpoint to trusted sources only until the upgrade is applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109573 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109573?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in phpMyFAQ 4.1.9

Ensure MySQL or MariaDB is not configured with NO_BACKSLASH_ESCAPES mode, or restrict network access to the phpMyFAQ api/autocomplete endpoint to trusted sources only until the upgrade is applied.

## Technical details

The PdoMysql::escape() method uses manual str_replace to produce backslash-escaped quotes (\'), which are treated as literal characters instead of escape sequences when MySQL/MariaDB operates in NO_BACKSLASH_ESCAPES mode. An attacker can bypass input filtering by supplying a Unicode right single quotation mark (U+2019) in the api/autocomplete search parameter, which passes through FILTER_SANITIZE_SPECIAL_CHARS unchanged, is then normalized to ASCII by the search class, and reaches the vulnerable escape function where the quote terminates the SQL string literal. This enables full SQL injection (UNION SELECT, INSERT, UPDATE, DELETE, DROP TABLE) on the backend database.

## Affected products

- thorsten phpMyFAQ before 4.1.9

## Timeline

- 2026-09-28: advisory
- 2026-10-12: disclosed

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385)
- [https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-sql-injection-via-api-autocomplete-search-endpoint](https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-sql-injection-via-api-autocomplete-search-endpoint)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)