Executive brief
A vulnerability in phpMyFAQ, an open-source FAQ software, allows administrative users with limited permissions to delete arbitrary folders on the server. By exploiting a flaw in how the system handles website addresses during the deletion of multisite instances, an attacker can remove critical system files, configuration data, or other users' information. This can lead to a complete service outage, data loss, or the destruction of the entire application installation.
Technical details
A path traversal vulnerability exists in the `Client::deleteClientFolder()` method within `src/phpMyFAQ/Instance/Client.php`. The function accepts a URL, strips the 'https://' prefix, and concatenates the remaining string directly to a base directory path without validating for traversal sequences like '../'. An attacker with `INSTANCE_DELETE` permissions can provide a crafted URL (e.g., `https://../../../path`) to recursively delete any directory writable by the web server process. This affects multisite deployments where subordinate admins can traverse outside their designated client folders to delete configuration files, cache, or other tenants' data. The issue is patched in version 4.1.2.
Affected products
- thorsten phpMyFAQ <= 4.1.1
Timeline
- 2026-04-28: disclosed
- 2026-05-06: advisory
- 2026-05-06: patched: Fixed in version 4.1.2