Executive brief
phpMyFAQ is an open-source FAQ software platform. A vulnerability in the administrative configuration interface allows an authorized administrator to upload and execute malicious code on the server. This could lead to a full takeover of the web server and access to all stored customer data.
Technical details
A remote code execution vulnerability exists in phpMyFAQ's configuration API due to improper validation of the 'upgrade.lastDownloadedPackage' setting. An authenticated attacker with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges can upload a malicious ZIP file as a standard attachment and then manually update the configuration to point the updater to the local path of that attachment. Because the 'extract-package' and 'install-package' endpoints trust this path without re-verifying its integrity or origin, the attacker can force the application to extract and install arbitrary PHP files into the web root. This bypasses the intended restriction that updates must originate from official signed sources. The issue is fixed in version 4.1.6.
Affected products
- thorsten phpMyFAQ < 4.1.6, 4.2.0-alpha
Timeline
- 2026-07-13: advisory: Vendor published security advisory GHSA-4fv7-8rr6-rf2w
- 2026-07-27: disclosed: CVE published to NVD