Executive brief
phpMyFAQ, an open-source FAQ software, contains a security flaw that allows authorized users to delete critical system files. By exploiting this, an attacker can remove the application's configuration file, which resets the software to its initial setup state. This allows the attacker to access the setup wizard and create a new administrative account, leading to a full takeover of the FAQ system and its data.
Technical details
A path traversal vulnerability exists in phpMyFAQ versions prior to 4.1.6 due to insufficient sanitization of the 'existing_image' field during category updates. While the application uses FILTER_SANITIZE_SPECIAL_CHARS, it fails to strip path traversal sequences like '../'. When a category is subsequently deleted, the Image::delete() function passes the unsanitized string directly to the PHP unlink() function. An authenticated attacker with category management privileges can use this to delete the 'database.php' configuration file. Deleting this file removes the 'installation gate,' allowing the attacker to access the public /setup/ directory and create a new superadmin account.
Affected products
- thorsten phpMyFAQ < 4.1.6, 4.2.0-alpha
Timeline
- 2026-07-13: advisory: Vendor GHSA published
- 2026-07-27: disclosed: NVD publication date