CVE-2026-76210 describes a vulnerability in phpMyFAQ prior to version 4.1.7 where insufficient sanitization of HTML content in FAQ answers leads to external control of file name or path during PDF generation with TCPDF. An attacker with limited privileges (permission to create or edit FAQ content) can embed an <img> tag with a src attribute pointing to local files within the web root's content/ directory. When the PDF export is triggered, phpMyFAQ attempts to read the referenced file as an image, fails, and throws an uncaught exception. The stack trace of this exception includes partial contents of the referenced file, which is disclosed to the user generating the PDF. The amount of disclosed data depends on the zend.exception_string_param_max_len configuration, potentially exposing sensitive files such as database configuration files containing credentials.

This vulnerability allows an attacker with limited permissions to disclose partial or potentially complete contents of local files under the web root's content/ directory by triggering PDF exports. Sensitive information such as database credentials may be exposed if the PHP configuration allows large exception string lengths. This can lead to information disclosure that may facilitate further attacks.

No official patch or remediation level is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to create or edit FAQ content to trusted users only. Monitor vendor communications for updates and apply official patches once released.