Path traversal in phpMyFAQ - #VU137471
Published: July 14, 2026
Vulnerability identifier: #VU137471
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Thorsten Rinne
Affected software:
phpMyFAQ
phpMyFAQ
Detailed vulnerability description
The vulnerability allows a remote user to create a new superadmin account and take over the application.
The vulnerability exists due to path traversal in the category image deletion functionality when updating a category with a crafted existing_image value and then deleting that category. A remote user can supply ../ sequences in the existing_image field to delete the database.php file and create a new superadmin account and take over the application.
Exploitation requires access to category update and delete functionality and the setup wizard becomes publicly accessible after the configuration file is removed.
Remediation
Install security update from vendor's website.