SB2026071455 - Multiple vulnerabilities in phpMyFAQ

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026071455

SB2026071455 - Multiple vulnerabilities in phpMyFAQ

Published: July 14, 2026

Security Bulletin ID SB2026071455
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 40% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper privilege management (CVE-ID: N/A)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper privilege management in GroupController::updateMembers when handling group membership assignment requests. A remote privileged user can add themselves or another user to a privileged group to escalate privileges.

No audit log entry is written for this action.


2) SQL injection (CVE-ID: CVE-2026-56738)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the StopWords::add() method when processing the user-supplied "word" parameter for stop-word insertion. A remote user can submit a specially crafted stop word value to execute arbitrary SQL commands.

Exploitation requires access to the administrative stop-word management feature.


3) Improper Authentication (CVE-ID: CVE-2026-56737)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass authentication and take over accounts.

The vulnerability exists due to improper authentication in the public two-factor verification endpoint `/check` when handling crafted authentication requests with an attacker-chosen `user-id` and TOTP token. A remote attacker can send a specially crafted request to bypass authentication and take over accounts.

Only accounts with two-factor authentication enabled are affected, and a valid password is not required for the affected login flow.


4) Download of code without integrity check (CVE-ID: N/A)

CWE-ID: CWE-494 - Download of Code Without Integrity Check

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to download of code without integrity check in the update package handling in the configuration and updater APIs when processing a user-controlled update-package path. A remote user can upload a crafted zip file, set the updater package path to it, and trigger extraction and installation to execute arbitrary code.

Exploitation requires CONFIGURATION_EDIT and ATTACHMENT_ADD permissions, and the crafted archive is installed into the application root through the updater workflow.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to create a new superadmin account and take over the application.

The vulnerability exists due to path traversal in the category image deletion functionality when updating a category with a crafted existing_image value and then deleting that category. A remote user can supply ../ sequences in the existing_image field to delete the database.php file and create a new superadmin account and take over the application.

Exploitation requires access to category update and delete functionality and the setup wizard becomes publicly accessible after the configuration file is removed.


Remediation

Install update from vendor's website.

References