# CVE-2026-47132: phpMyFAQ SQL LIKE wildcard injection in chat user search

Source: https://junglewise.ai/threats/cve-2026-47132-phpmyfaq-sql-like-wildcard-injection-in-chat-user-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-47132 · Severity: medium · CVSS 5.4 · Published 2026-09-24

phpMyFAQ, an open-source FAQ software, contains a vulnerability in its chat user search feature. An authenticated user can bypass search filters to view a list of all active users, including their IDs and display names. This could lead to the exposure of internal staff identities, department names, or other sensitive account information.

Technologies: [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47132 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47132 being exploited in the wild.

**How severe is CVE-2026-47132?** Medium severity, with a CVSS score of 5.4, published 24 September 2026.

**Which products and versions are affected?** thorsten/phpmyfaq (Packagist) < 4.2.0-alpha, ECOSYSTEM:introduced=0,fixed=4.2.0-alpha.

**Is there a fix for CVE-2026-47132?** Yes. thorsten/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47132 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-47132?** Check whether you run thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- thorsten/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later

  ```sh
  composer require thorsten/phpmyfaq:^4.2.0-alpha
  ```


## Technical details

The vulnerability exists in the `ChatController.php` and `Chat.php` components of phpMyFAQ. While the application uses an `escape()` method to prevent standard SQL string breakout, it fails to neutralize SQL `LIKE` metacharacters such as `%` and `_` in the `searchTerm` parameter of the `/api/chat/users` endpoint. An authenticated attacker can provide these wildcards to bypass the intended search logic and retrieve all active user records from the `faquser` and `faquserdata` tables. This issue is addressed in version 4.2.0-alpha by implementing proper wildcard escaping.

## Affected products

- thorsten phpMyFAQ < 4.2.0-alpha

## Identifiers

- CVE-2026-47132
- GHSA-6pvm-2vjj-rx4w

## Timeline

- 2026-08-08: disclosed
- 2026-08-08: patched: Patched in version 4.2.0-alpha via commit bd4b08b
- 2026-08-12: advisory

## References

- [https://api.github.com/users/proochicken](https://api.github.com/users/proochicken)
- [https://github.com/proochicken](https://github.com/proochicken)
- [https://api.github.com/users/proochicken/gists%7B/gist_id%7D](https://api.github.com/users/proochicken/gists%7B/gist_id%7D)
- [https://api.github.com/users/proochicken/repos](https://api.github.com/users/proochicken/repos)
- [https://avatars.githubusercontent.com/u/190519836?v=4](https://avatars.githubusercontent.com/u/190519836?v=4)
- [https://api.github.com/users/proochicken/events%7B/privacy%7D](https://api.github.com/users/proochicken/events%7B/privacy%7D)

## Related threats

- [phpMyFAQ SQL injection in StopWords::add()](https://junglewise.ai/threats/cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add)
- [phpMyFAQ two-factor authentication password bypass](https://junglewise.ai/threats/cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass)
- [phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass](https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass)
- [phpMyFAQ information disclosure of inactive FAQ content in public API](https://junglewise.ai/threats/cve-2026-57994-phpmyfaq-information-disclosure-of-inactive-faq-content-in-public)
- [phpMyFAQ path traversal in PDF export concatenatePaths function](https://junglewise.ai/threats/cve-2026-57961-phpmyfaq-path-traversal-in-pdf-export-concatenatepaths-function)