CVE-2026-34728: phpMyFAQ Path Traversal Vulnerability Leading to Arbitrary File Deletion
Summary
CVE-2026-34728: phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController. Affects phpmyfaq/phpmyfaq versions < 4.1.1. Fixed in 4.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyFAQ is an open-source FAQ management system that allows users to create and manage FAQs easily. It provides features such as user management, multilingual support, and a customizable interface. However, it has a vulnerability in the MediaBrowserController that allows unauthorized file deletion due to insufficient input validation.
Vulnerability Detail
The vulnerability arises from the MediaBrowserController::index() method, which handles file deletion without proper path traversal validation. The user-supplied 'name' parameter is concatenated with the base upload directory path, allowing attackers to exploit this by using directory traversal sequences like '../'. Additionally, the lack of CSRF protection makes it susceptible to CSRF attacks, enabling unauthorized file deletions. This could lead to severe consequences, including server compromise, data loss, and exposure of sensitive files.
How To Fix
Minimum fixed version
4.1.1
This is the first release that contains the fix.
composer require phpmyfaq/phpmyfaq:4.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the file removal functionality until the patch is applied. Additionally, implement server-side restrictions to prevent unauthorized access to sensitive files.
Conclusion
In summary, CVE-2026-34728 is a critical vulnerability in phpMyFAQ that allows for arbitrary file deletion due to inadequate input validation and missing CSRF protection. It is essential to update to the latest version and implement the recommended fixes to secure your application.
See every vulnerability recorded for phpmyfaq/phpmyfaq →
FAQ
CVE-2026-34728 is a vulnerability in phpMyFAQ that allows attackers to perform arbitrary file deletion due to insufficient input validation and lack of CSRF protection.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include server compromise, data loss, exposure of sensitive files, and potential application failure.
You can update phpMyFAQ to version 4.1.1 or later using Composer with the command: composer update phpmyfaq/phpmyfaq.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyfaq/phpmyfaq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
