CVE-2026-57961: phpMyFAQ Authenticated Path Traversal in PDF Export
Summary
CVE-2026-57961: phpMyFAQ has Potential Authenticated Path Traversal in PDF Export. Affects thorsten/phpmyfaq versions >= 4.0.0-alpha, < 4.1.5. Fixed in 4.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyFAQ is an open-source FAQ management system that allows users to create and manage FAQ entries efficiently. It provides features such as content categorization, user management, and PDF export functionality. However, a vulnerability has been identified in the PDF export feature that could allow privileged users to exploit the system.
Vulnerability Detail
The vulnerability arises from an authenticated path traversal condition in the PDF export functionality, specifically in the image resolution logic. The function 'concatenatePaths()' improperly handles user-controlled paths, allowing an attacker with FAQ editing privileges to craft paths that can read files outside the intended content directory. This could lead to the disclosure of sensitive files, depending on file permissions and the nature of the files being accessed.
How To Fix
Minimum fixed version
4.1.5
This is the first release that contains the fix.
composer require thorsten/phpmyfaq:4.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid allowing FAQ editors to include arbitrary paths in image tags within the FAQ content. Implement strict validation of image paths to ensure they are contained within the expected content directory.
Conclusion
The CVE-2026-57961 vulnerability in phpMyFAQ poses a moderate risk due to its potential for path traversal attacks by authenticated users. It is crucial to update to the latest version and implement recommended security measures to protect sensitive data.
See every vulnerability recorded for thorsten/phpmyfaq →
FAQ
CVE-2026-57961 is a vulnerability in phpMyFAQ that allows authenticated users to exploit path traversal in the PDF export functionality.
Users with FAQ editing privileges in phpMyFAQ versions prior to 4.1.5 are affected by this vulnerability.
Exploitation of this vulnerability may lead to unauthorized access to sensitive files on the server, potentially disclosing confidential information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update to phpMyFAQ version 4.1.5 or later and implement path validation measures to ensure that user-controlled paths do not lead outside the intended directories.
References
Related vulnerabilities
Recent vulnerabilities recorded for thorsten/phpmyfaq.
