Server-Side Request Forgery (SSRF) in phpMyFAQ - #VU164480
Published: November 10, 2026
Vulnerability identifier: #VU164480
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to induce requests to internal HTTP services and potentially disclose sensitive information through generated PDFs.
The vulnerability exists due to insufficient destination restrictions in phpMyFAQ PDF export when fetching FAQ images with localhost permitted in records.allowedMediaHosts. A remote user can insert <img src="http://localhost:9321/internal-secret.png"> into FAQ content they can modify and request its PDF export to trigger server-side retrieval and embed the returned image, potentially exposing internal information.
Affected software
phpMyFAQ
Remediation
Install security update from vendor's website.
phpMyFAQ - update to 4.1.10