Threat database

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications.

phpMyFAQ versions prior to 4.1.7 contain a missing authorization vulnerability where parent FAQ visibility checks are not enforced before returning child resources such as comments and attachments. This allows unauthenticated attackers to access restricted comment text, commenter email addresses, and attachment filenames for FAQ entries they cannot directly access.

phpMyFAQ versions before 4.1.7 have an authentication bypass vulnerability due to failure to persist the WebAuthn login challenge. This allows an attacker who captures a valid WebAuthn assertion to replay it indefinitely and authenticate as the user without interaction or hardware key.

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.

phpMyFAQ versions before 4.1.7, when using the native pgsql PHP extension for PostgreSQL, improperly handle wildcard escaping in SQL LIKE queries. This flaw allows unauthenticated attackers to submit wildcard characters in the public FAQ search form, causing broad pattern matches and expensive sequential scans that can lead to denial of service. The issue does not affect the PDO PostgreSQL backend and does not enable SQL injection or data exfiltration.

phpMyFAQ versions before 4.1.7 have a missing authorization vulnerability in the admin API read endpoints related to LDAP, Elasticsearch, OpenSearch, and dashboard configuration. This flaw allows any authenticated user to access sensitive administrative data without proper permission checks. Exploitation can reveal LDAP server topology, bind account names, search bases, index statistics, and site analytics.

phpMyFAQ versions before 4.1.6 have a vulnerability where HTML in FAQ answers is not properly sanitized before generating PDFs using TCPDF. An attacker with permission to create or edit FAQ content can embed an <img> tag referencing local files under the web root's content/ directory. When the PDF is generated, phpMyFAQ tries to read the referenced file, causing an error that results in an uncaught exception. This exception discloses part of the file's contents in the stack trace to any user triggering the PDF export. The disclosed content is truncated by default but can be configured to reveal entire files, including sensitive data like database credentials.

phpMyFAQ versions before 4.1.6 contain a vulnerability where the security.enableRegistration setting is not validated in certain API endpoints. This allows attackers to create user accounts even when registration is disabled via the web interface. The flaw affects the POST /api/register and POST /api/v3.1/register endpoints, which bypass the intended registration restriction.

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which overwrites the account_status column of a pre-existing local account from 'blocked' to 'active'. As a result, a user whose local phpMyFAQ account has been administratively blocked can restore their account and log in by authenticating via LDAP. The state transition is not logged, so administrators cannot detect that the block was overridden. Fixed in 4.1.7.

phpMyFAQ versions prior to 4.1.7 have a vulnerability in the two-factor authentication process where remember-me tokens are issued before the second-factor verification completes. This allows attackers with valid credentials to bypass 2FA by replaying the remember-me cookie, gaining full authenticated access without completing the second-factor challenge.

phpMyFAQ versions prior to 4.1.7 contain a vulnerability in the PDF export endpoint that allows unauthenticated attackers to access draft FAQ metadata. This occurs because the application fails to validate the active status of FAQs, enabling retrieval of titles, solution IDs, author names, and last-update timestamps for inactive or unpublished FAQs via sequential FAQ identifiers.

phpMyFAQ versions before 4.1.7 have a SQL injection vulnerability in the glossary create and update endpoints. Authenticated users with glossary add or edit permissions can exploit this by crafting a payload with a dangling backslash that escapes the closing quote, allowing arbitrary SQL commands to be injected. This vulnerability can lead to unauthorized reading of sensitive database information.

phpMyFAQ versions prior to 4.1.6 create backup ZIP archives in a web-accessible location named content.zip, exposing sensitive data such as database credentials. Unauthenticated attackers can exploit a race condition to download these temporary files before deletion. Additionally, cross-site scripting (XSS) vulnerabilities in admin contexts may allow attackers to trigger backups and retrieve the archive. This vulnerability has a medium severity rating with a CVSS 4.0 score of 6.0.

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backup endpoints to execute database updates, disable maintenance mode, and extract database credentials from generated ZIP archives.

phpMyFAQ versions before 4.1.7 have a vulnerability where password reset tokens are stored in a publicly accessible tracking file if user tracking is enabled. This allows unauthenticated attackers to read these tokens and use them to reset passwords, potentially taking over user accounts.

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.

phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BACKUP). The same fix was not applied to 4 other write endpoints in the public API. All 4 only call $this->hasValidToken() — which checks a shared API key header, rather than the individual user's role permissions. The following APIs are affected: POST /api/v4.0/category (CategoryController::create), POST /api/v4.0/faq (FaqController::create), PUT /api/v4.0/faq (FaqController::update), and POST /api/v4.0/question (QuestionController::create). This issue has been fixed in version 4.1.4.

phpMyFAQ versions prior to 4.1.4 use SHA-1, a cryptographically broken hash algorithm, for hashing attachment passwords. SHA-1 has been vulnerable to collision attacks since 2017. This weakness was addressed in version 4.1.4.