CVE-2026-45008 is a path traversal vulnerability in phpMyFAQ prior to version 4.1.2. It exists in the Client::deleteClientFolder function, which improperly validates the client URL parameter. Administrators with INSTANCE_DELETE permission can exploit this by submitting traversal sequences (e.g., https://../../../<path>) to delete directories recursively outside the designated clientFolder directory. This can result in unauthorized deletion of files and directories, impacting integrity and availability. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H). No vendor advisory or patch link is currently provided, and the product is not a cloud service.

Successful exploitation allows privileged administrators to delete arbitrary directories on the server, potentially causing significant data loss and service disruption. The vulnerability impacts integrity and availability but does not affect confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict INSTANCE_DELETE permissions to trusted administrators only and monitor for suspicious deletion activity. Avoid exposing the vulnerable function to untrusted inputs. No official patch or workaround is currently documented.