CVE-2026-57961: phpMyFAQ Authenticated Path Traversal in PDF Export

Technical summary

The vulnerability exists in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. The function uses strpos() to locate the substring "content" within a user-supplied file path to establish a boundary for path normalization. When strpos() fails to find "content", it returns false, which is then cast to integer 0. This casting error causes the path-resolution logic to preserve the entire attacker-controlled path unchanged. The unvalidated path is subsequently passed to file_get_contents() during PDF generation without canonicalization or root-directory containment checks, enabling directory traversal and arbitrary file read access on the host system.

Business impact

The risk to most organizations is limited by the authentication and privilege requirements. However, organizations with multiple FAQ contributors or shared editing roles should evaluate whether internal users pose a threat to sensitive configuration files, database credentials, or private data that might be readable by the web server process. The exposure is restricted to confidentiality; integrity and availability are not affected. In low-trust environments or those with high staff turnover, unauthorized file disclosure could compromise system security posture.

Affected systems

phpMyFAQ versions before 4.1.5 are vulnerable. The vendor_products field in the source data is empty, indicating no specific product variants were enumerated in the ground-truth feed; however, all instances of phpMyFAQ below version 4.1.5 should be assumed in scope. Verify your installation version via the phpMyFAQ admin interface or package management system to confirm exposure.

Exploitability

Exploitation requires two preconditions: (1) valid authentication to the phpMyFAQ application, and (2) FAQ editing privileges. The attacker must then craft HTML with malicious image paths in a FAQ entry and trigger PDF export. No network-level exploit or public proof-of-concept is needed—the attack is a straightforward path traversal using directory-traversal sequences (e.g., ../) embedded in image src attributes. The barrier to exploitation is moderate due to privilege requirements, but once authenticated, the attack is reliable and requires minimal user interaction.

Remediation

Upgrade phpMyFAQ to version 4.1.5 or later. This update corrects the path-resolution logic to properly validate and canonicalize file paths before passing them to file operations. Organizations unable to upgrade immediately should restrict FAQ editing privileges to trusted administrators only and monitor PDF export logs for suspicious activity or unusual file-access patterns.

Patch guidance

1. Verify your current phpMyFAQ version in the admin dashboard or via the command line. 2. Back up your FAQ database and configuration files before upgrading. 3. Update to phpMyFAQ 4.1.5 or the latest available version from the official phpMyFAQ repository or vendor distribution channel. 4. Test PDF export functionality in a staging environment to ensure the patch does not break existing workflows. 5. After deployment, confirm the version upgrade and re-run any internal vulnerability scans to validate remediation.

Detection guidance

Monitor PDF export requests for unusual image source paths containing traversal sequences (e.g., ../, ..\ or encoded variants). Log FAQ content modifications and exports by user and timestamp. Review web server access logs for file_get_contents() errors or attempts to read files outside the /content directory during PDF generation. Consider implementing a Web Application Firewall (WAF) rule to block FAQ submissions containing image paths with directory-traversal indicators, as an interim preventive measure.

Why prioritize this

Although the CVSS score is 2.7 (LOW), this vulnerability warrants attention in any phpMyFAQ deployment with multiple FAQ editors or untrusted contributors. It is not remotely exploitable without authentication and does not affect confidentiality of the entire system—only files readable by the web server. Prioritization should be based on the sensitivity of data accessible to the web server process and the number of FAQ editors in your organization. Organizations with restrictive FAQ editing policies and dedicated FAQ administrators may safely defer this patch; those with broader contributor bases should upgrade sooner.

Risk score, explained

The CVSS 3.1 score of 2.7 reflects the low severity due to the requirement for authenticated access (PR:H, high privilege required) and the absence of network attack feasibility or impact to integrity and availability. The score accounts only for confidentiality loss (C:L). The score does not capture organization-specific risk; internal threat modeling and data sensitivity should inform your own risk decisions.

Frequently asked questions