Path traversal in phpMyFAQ - CVE-2026-66397
Published: July 14, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU137471
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-66397
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create a new superadmin account and take over the application.
The vulnerability exists due to path traversal in the category image deletion functionality when updating a category with a crafted existing_image value and then deleting that category. A remote user can supply ../ sequences in the existing_image field to delete the database.php file and create a new superadmin account and take over the application.
Exploitation requires access to category update and delete functionality and the setup wizard becomes publicly accessible after the configuration file is removed.
Affected software
phpMyFAQ
How to mitigate CVE-2026-66397
Install security update from vendor's website.
phpMyFAQ - update to 4.1.6