CVE-2026-109573: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in thorsten phpMyFAQ

CVE-2026-109573 is an SQL injection vulnerability in phpMyFAQ's PdoMysql::escape() method that improperly neutralizes special elements in SQL commands. The vulnerability occurs because the function escapes single quotes with backslashes, but when MySQL or MariaDB operates in NO_BACKSLASH_ESCAPES mode, these backslashes are treated literally, failing to prevent injection. Attackers can exploit this by submitting a Unicode right single quotation mark in the api/autocomplete search parameter, which normalizes to an ASCII quote, enabling unauthorized access to credentials, configuration secrets, and database manipulation including record modification and table deletion. The affected versions are phpMyFAQ before 4.1.9 and certain 4.2.0 alpha/beta versions.

Successful exploitation allows unauthenticated attackers to perform SQL injection attacks, potentially leading to disclosure of sensitive credentials and configuration data, unauthorized modification of database records, and deletion of tables. This can compromise the confidentiality, integrity, and availability of the affected phpMyFAQ installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running MySQL or MariaDB in NO_BACKSLASH_ESCAPES mode or restrict access to the vulnerable api/autocomplete endpoint. Monitor vendor channels for updates and apply patches promptly once released.