SB20261110337 - Server-Side Request Forgery (SSRF) in phpMyFAQ

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110337

SB20261110337 - Server-Side Request Forgery (SSRF) in phpMyFAQ

Published: November 10, 2026

Security Bulletin ID SB20261110337
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to induce requests to internal HTTP services and potentially disclose sensitive information through generated PDFs.

The vulnerability exists due to insufficient destination restrictions in phpMyFAQ PDF export when fetching FAQ images with localhost permitted in records.allowedMediaHosts. A remote user can insert <img src="http://localhost:9321/internal-secret.png"> into FAQ content they can modify and request its PDF export to trigger server-side retrieval and embed the returned image, potentially exposing internal information.


Remediation

Install update from vendor's website.

References