Quick answers
- Is CVE-2026-111901 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111901 being exploited in the wild.
- How severe is CVE-2026-111901?
- High severity, with a CVSS score of 7.5, published 17 October 2026.
- Which products and versions are affected?
- Phpmyfaq 4.2.0-alpha before 4.2.0-beta.
- Is there a fix for CVE-2026-111901?
- Yes: fixed in 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-111901 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-111901?
- Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.2.0-beta
Technical details
The REST API endpoints GET /api/v4.0/faqs and GET /api/v4.0/search implement pagination at the application level rather than the database level, fetching all matching records into PHP memory before processing and slicing. An unauthenticated attacker can send concurrent requests to exhaust resources (CWE-400). Affected versions prior to 4.2.0-beta lack database-level LIMIT/OFFSET pagination, making each request expensive as the application strips HTML tags, sorts results, and then discards most of the data.
Affected products
- phpMyFAQ phpMyFAQ 4.2.0-alpha before 4.2.0-beta
Timeline
- 2026-10-03: advisory
- 2026-10-17: disclosed