The vulnerability in phpMyFAQ prior to version 4.1.5 exists in the concatenatePaths() function located in src/phpMyFAQ/Export/Pdf/Wrapper.php. The function attempts to locate the substring "content" within user-controlled image paths using strpos(). If "content" is not found, strpos() returns false, which is cast to 0, causing the entire attacker-controlled path to be preserved. This path is then passed to file_get_contents() without proper canonicalization or root-directory containment checks, enabling an authenticated user with FAQ editing privileges to read arbitrary files outside the intended content directory. This is classified as a CWE-22 (Path Traversal) vulnerability.

An authenticated user with FAQ editing privileges can exploit this vulnerability to read arbitrary files on the server outside the intended content directory during PDF generation. This could lead to unauthorized disclosure of sensitive information stored on the server. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict FAQ editing privileges to trusted users only to reduce risk. Monitor vendor channels for updates regarding a patch or official mitigation.