SB2026071454 - Multiple vulnerabilities in phpMyFAQ

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026071454

SB2026071454 - Multiple vulnerabilities in phpMyFAQ

Published: July 14, 2026

Security Bulletin ID SB2026071454
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-57961)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in concatenatePaths() in src/phpMyFAQ/Export/Pdf/Wrapper.php when processing crafted image paths during PDF generation. A remote privileged user can store HTML containing a crafted image path to disclose sensitive information.

Exploitation requires FAQ editing capabilities, and practical disclosure depends on how stored HTML, file contents, and PDF rendering are handled at runtime.


2) Incorrect authorization (CVE-ID: CVE-2026-57994)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to incorrect authorization in public FAQ API endpoints when handling requests for inactive FAQ entries. A remote attacker can send crafted API requests to disclose sensitive information.

Public routes can return inactive FAQ titles, previews, and in some cases full answer content that is intended to remain non-public.


3) Improper privilege management (CVE-ID: CVE-2026-57995)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper privilege management in GroupController::updatePermissions when handling permission-update requests. A remote user can submit a crafted POST request that grants a group rights they do not hold to escalate privileges.

Exploitation requires the delegated GROUP_EDIT permission and the attacker must be a member of the targeted group, or otherwise able to place themselves into that group.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to missing authorization in the admin API user/add endpoint when handling crafted user-creation requests with the isSuperAdmin flag. A remote user can create a new account with superadmin privileges and an attacker-chosen password to escalate privileges.

Exploitation requires delegated user-management permissions and no user interaction.


Remediation

Install update from vendor's website.

References