phpMyFAQ before version 4.1.1 contains a path traversal vulnerability in the MediaBrowserController::index() method used for file deletion. The user-controlled 'name' parameter is concatenated with the base upload directory path without sufficient validation to prevent directory traversal. The FILTER_SANITIZE_SPECIAL_CHARS filter applied does not block directory traversal sequences like '../'. Furthermore, the fileRemove action endpoint does not validate CSRF tokens, enabling exploitation via CSRF attacks. This combination allows an attacker with at least limited privileges and user interaction to delete arbitrary files on the server. The issue was fixed in phpMyFAQ version 4.1.1.

Successful exploitation can lead to unauthorized deletion of arbitrary files on the server due to path traversal. The lack of CSRF protection increases the risk by allowing attackers to trigger the file deletion action via CSRF attacks. The CVSS score of 8.7 (high severity) reflects the network attack vector, low attack complexity, requirement for privileges and user interaction, and impact on integrity and availability. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

Upgrade phpMyFAQ to version 4.1.1 or later, where this vulnerability has been patched. The patch includes proper validation of the file path to prevent directory traversal and adds CSRF token validation to the fileRemove action endpoint. Until upgrading, restrict access to the affected functionality to trusted users only and consider additional protective controls to prevent CSRF attacks. Patch status is confirmed as fixed in version 4.1.1.