Information Exposure Through an Error Message in phpMyFAQ - CVE-2026-76210
Published: August 4, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU140888
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76210
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to generation of error messages containing sensitive information in the PDF export HTML image handling path when processing crafted FAQ HTML during PDF generation. A remote user can store a crafted <img> tag that references a local file under the content/ directory to disclose sensitive information.
After the crafted FAQ content has been published, the disclosure can be triggered by requesting the PDF export endpoint, and larger portions of file contents may be exposed when the PHP exception string length setting is increased.
Affected software
phpMyFAQ
How to mitigate CVE-2026-76210
Install security update from vendor's website.
phpMyFAQ - update to 4.1.7