CVE-2026-75920: Insecure Temporary File in thorsten phpMyFAQ

CVE-2026-75920 affects phpMyFAQ versions before 4.1.6. The software writes backup ZIP archives containing sensitive information to the web-accessible document root as content.zip. This insecure temporary file handling allows unauthenticated attackers to perform a race condition attack to download the backup file before it is deleted. Furthermore, XSS vulnerabilities in administrative contexts can be exploited to trigger authenticated backup creation and subsequent retrieval of the archive. The vulnerability is rated medium severity with a CVSS 4.0 vector indicating network attack vector, high attack complexity, partial attack type, no privileges required, partial user interaction, and high vulnerability confidentiality impact.

Sensitive files including database credentials may be exposed to unauthenticated attackers due to the backup ZIP archive being stored in a publicly accessible location. This exposure can lead to unauthorized data disclosure. The race condition allows attackers to download the backup file before it is deleted, and XSS in admin contexts can be leveraged to trigger backups and retrieve sensitive data. The overall impact is medium severity as per the CVSS 4.0 score of 6.0.

A fixed version 4.1.6 or later addresses this vulnerability by preventing the creation of backup ZIP archives in web-accessible locations. Users should upgrade to phpMyFAQ version 4.1.6 or later to remediate this issue. No other mitigation details are provided; patching is the recommended action.