CVE-2026-48488: phpMyFAQ weak cryptographic hash for attachment passwords

Executive brief

phpMyFAQ, an open-source FAQ software, uses an outdated and insecure method (SHA-1) to protect passwords for file attachments. This could allow an attacker to bypass password protection on sensitive documents or quickly crack passwords if they gain access to the system's database. Organizations using this software should update to ensure their shared files remain confidential.

Technical details

phpMyFAQ versions up to and including 4.1.3 utilize SHA-1 for hashing attachment passwords in `src/phpMyFAQ/Attachment/AbstractAttachment.php`. SHA-1 is vulnerable to collision attacks and lacks the computational cost required to resist modern brute-force or rainbow table attacks. An attacker with network access could potentially bypass attachment protections via hash collisions or perform offline cracking in under a minute if the database is compromised. The vulnerability is addressed in version 4.1.4 by migrating to the bcrypt (PASSWORD_BCRYPT) hashing algorithm.

Affected products

• thorsten phpMyFAQ <= 4.1.3

Timeline

• 2026-05-25: disclosed
• 2026-06-08: advisory: NVD publication date
• 2026-06-23: patched: GitHub Advisory reviewed and updated

References

• https://api.github.com/users/N0tFix3d
• https://github.com/N0tFix3d
• https://api.github.com/users/N0tFix3d/gists%7B/gist_id%7D
• https://api.github.com/users/N0tFix3d/repos
• https://avatars.githubusercontent.com/u/36280029?v=4
• https://api.github.com/users/N0tFix3d/events%7B/privacy%7D