Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck
CVE-2026-57961phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function
Low 2.7
In plain English
A low-severity path traversal in phpMyFAQ from phpMyFAQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring "content" within a user-controlled path using strpos(); when "content" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the entire attacker-controlled path. This path is later passed to file_get_contents() without canonicalization or root-directory containment validation, which may allow reading of files outside the intended content directory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | 4.1.5 | GHSA-88g4-74f3-63x9 |
| Packagist | thorsten/phpmyfaq | 4.1.5 | GHSA-88g4-74f3-63x9 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N