Vulnerability · Published Jul 27, 2026 · Assigned by VulnCheck

CVE-2026-66398phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

Critical 9.4

In plain English

A critical-severity security flaw in phpMyFAQ from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.4%top 64.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpMyFAQ	0 – before 4.1.6

Weakness: CWE-494 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

GitHub Security Advisory (GHSA-4fv7-8rr6-rf2w) vendor-advisory
VulnCheck Advisory: phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API third-party-advisory