CVE-2026-46364: phpMyFAQ SQL injection in BuiltinCaptcha via User-Agent header

CVE-2026-46364 · Severity: critical · CVSS 9.8 · Published 2026-05-15

phpMyFAQ, a popular open-source FAQ software, contains a security flaw that allows anyone on the internet to access or modify its database without a password. By sending a specially crafted web request, an attacker can steal sensitive information like administrator login credentials, email settings, and private FAQ content. This could lead to a total takeover of the FAQ system or the deletion of important data.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist), Thorsten phpMyFAQ. Vendors: Packagist, Thorsten.

Quick answers

Is CVE-2026-46364 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46364 being exploited in the wild.
How severe is CVE-2026-46364?
Critical severity, with a CVSS score of 9.8, published 15 May 2026.
Which products and versions are affected?
phpmyfaq/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.
Is there a fix for CVE-2026-46364?
Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46364 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46364?
Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later
    composer require phpmyfaq/phpmyfaq:^4.1.2
  • thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later
    composer require thorsten/phpmyfaq:^4.1.2

Technical details

An unauthenticated SQL injection vulnerability exists in phpMyFAQ's BuiltinCaptcha.php. The `garbageCollector()` and `saveCaptcha()` methods use `sprintf()` to interpolate the `User-Agent` HTTP header and client IP address directly into SQL DELETE and INSERT queries without proper escaping or parameterization. These methods are triggered by any GET request to the `/api/captcha` endpoint. An attacker can exploit this to perform time-based blind SQL injection to exfiltrate sensitive data (such as bcrypt password hashes from the `faquser` table) or modify/delete database records. The vulnerability is patched in version 4.1.2.

Affected products

  • thorsten phpMyFAQ <= 4.1.1

Identifiers

  • CVE-2026-46364
  • GHSA-289f-fq7w-6q2w

Timeline

  • 2026-04-28: disclosed: Initial disclosure to vendor
  • 2026-05-06: advisory: GitHub Advisory published
  • 2026-05-06: patched: Fix released in version 4.1.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.