Path traversal in phpMyFAQ - CVE-2026-57961
Published: July 14, 2026
Vulnerability identifier: #VU137459
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-57961
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Thorsten Rinne
Affected software:
phpMyFAQ
phpMyFAQ
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to path traversal in concatenatePaths() in src/phpMyFAQ/Export/Pdf/Wrapper.php when processing crafted image paths during PDF generation. A remote privileged user can store HTML containing a crafted image path to disclose sensitive information.
Exploitation requires FAQ editing capabilities, and practical disclosure depends on how stored HTML, file contents, and PDF rendering are handled at runtime.
How to mitigate CVE-2026-57961
Install security update from vendor's website.