phpMyFAQ versions prior to 4.1.6 do not properly sanitize the existing_image field during category updates, enabling authenticated users to perform path traversal attacks. This vulnerability allows deletion of arbitrary files via the Image::delete() function. Specifically, attackers can remove the database.php configuration file, which disables the installation gate and grants access to the setup wizard for creating superadmin accounts. The CVSS 4.0 score is 8.6, indicating a high-severity vulnerability with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

Successful exploitation permits authenticated attackers to delete critical files, including the database.php configuration file. This leads to disabling the installation gate and unauthorized access to the setup wizard, enabling creation of new superadmin accounts. The compromise of superadmin accounts can result in full control over the phpMyFAQ installation, severely impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious activity related to category updates and file deletions. Avoid using vulnerable versions in production environments.