CVE-2026-45008 is a path traversal vulnerability in phpMyFAQ prior to version 4.1.2. It exists in the Client::deleteClientFolder function, where an admin user with INSTANCE_DELETE permission can supply a client URL parameter containing traversal sequences (e.g., ../../../<path>) to recursively delete directories outside the designated clientFolder. This improper validation of file paths allows deletion of arbitrary directories on the server filesystem, potentially impacting system integrity and availability. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on integrity and availability.

Successful exploitation allows an administrator with specific permissions to delete arbitrary directories on the server, which can lead to loss of data and disruption of service. There is no confidentiality impact reported. The vulnerability affects system integrity and availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict INSTANCE_DELETE permissions to trusted administrators only and monitor for suspicious deletion activity. Avoid exposing administrative interfaces to untrusted networks.