Executive brief
phpMyFAQ is a popular open-source FAQ management system used by organizations to publish and organize knowledge bases. Administrators with FAQ editing privileges can exploit a flaw in the PDF export feature to read sensitive files from the server by embedding specially crafted image paths in FAQ content. When the PDF is generated, the application bypasses its directory containment safeguards and may expose sensitive information like configuration files or system data to anyone who downloads the PDF.
Technical details
The vulnerability is a path traversal (CWE-22) in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. The root cause is insecure path resolution logic that searches for the substring "content" using strpos() on a user-controlled path. When "content" is not present, strpos() returns false, which is cast to 0, causing the entire attacker-controlled path (e.g., "../../../etc/passwd") to be preserved. The resulting path is passed to file_get_contents() without canonicalization or root-directory validation. Attack requires authentication and FAQ editing privileges, but no further user interaction. An authenticated attacker can embed crafted HTML image tags in FAQ entries; when PDF export is triggered, the malicious paths are processed and may disclose readable files depending on file type and PDF rendering constraints. Patched in version 4.1.5; affected versions are 4.0.0-alpha through 4.1.4.
Affected products
- Thorsten Hahn phpMyFAQ 4.0.0-alpha to 4.1.4
Timeline
- 2026-06-14: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: Version 4.1.5 released with fix