CVE-2026-76210: External Control of File Name or Path in thorsten phpMyFAQ

CVE-2026-76210 affects phpMyFAQ versions prior to 4.1.6. The vulnerability arises because the application does not adequately sanitize HTML content in FAQ answers before generating PDFs via TCPDF. An attacker with limited privileges to create or edit FAQ entries can embed an <img> tag with a src attribute pointing to local files within the web root's content/ directory. During PDF generation, phpMyFAQ attempts to read these files as images, which fails and triggers an uncaught exception. The stack trace of this exception is exposed in the PDF export process, leaking partial or full contents of the referenced files depending on configuration. This can lead to disclosure of sensitive files such as configuration files containing database credentials.

This vulnerability allows an attacker with permission to create or edit FAQ content to disclose sensitive local files on the server by embedding references to them in FAQ answers. The disclosed data can include critical information like database credentials, potentially compromising the confidentiality of the system. The vulnerability does not require user interaction or elevated privileges beyond content editing rights. The CVSS 4.0 score is 7.1 (high severity), reflecting the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

A fixed version of phpMyFAQ is available starting from version 4.1.6. Users should upgrade to version 4.1.6 or later to remediate this vulnerability. Until upgrading, restrict permissions to create or edit FAQ content to trusted users only. Avoid configurations that increase the length of exception string parameters to limit potential data disclosure. Review and sanitize FAQ content to prevent embedding of malicious HTML tags referencing local files.