CVE-2026-76212: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in thorsten phpMyFAQ

phpMyFAQ before version 4.1.7, when configured with the native pgsql PHP extension for PostgreSQL, incorrectly declares the LIKE ESCAPE character as '=' in the Search/Database/Pgsql.php backend. Meanwhile, the escapeLikeWildcards() function escapes user input with the '|' prefix, rendering wildcard escaping ineffective. Consequently, user-supplied '%' and '_' characters remain active as LIKE wildcards. An unauthenticated attacker can exploit this by submitting such characters in the public FAQ search form, triggering broad pattern matches and costly sequential scans that result in denial of service. The PDO PostgreSQL backend is unaffected, and quote escaping remains intact, preventing SQL injection or data exfiltration.

An unauthenticated attacker can cause a denial of service by submitting wildcard characters in the public FAQ search form, leading to expensive database queries and resource exhaustion. There is no risk of SQL injection or data leakage from this vulnerability.

Patch to phpMyFAQ version 4.1.7 or later where this issue is fixed. If upgrading is not immediately possible, consider disabling the native pgsql PHP extension backend or restricting access to the public FAQ search form to mitigate denial of service risk. Patch status is not yet confirmed explicitly in the provided data; check the vendor advisory for current remediation guidance.