CVE-2026-66398
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
phpMyFAQ before version 4.1.6 contains a remote code execution vulnerability in the configuration API. An authenticated administrator with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges can manipulate the upgrade.lastDownloadedPackage setting to write arbitrary PHP files and achieve code execution as the web server user.
Risk Assessment
An attacker with admin privileges can upload a malicious ZIP file as an attachment and use the update mechanism to extract it into the application root, enabling remote code execution and full server compromise.
Recommendation
Immediately update phpMyFAQ to version 4.1.6 or later and restrict administrator privileges to the minimum necessary.
Original NVD description (English source)
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.