CVE-2026-66397 in phpMyFAQ
Summary
by MITRE • 07/27/2026
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
phpMyFAQ version 4.1.5 and earlier contains a critical path traversal vulnerability in its image handling functionality that stems from inadequate input validation during category updates. The flaw exists specifically in the existing_image field processing where the system fails to properly sanitize user-supplied paths before executing file deletion operations through the Image::delete() method. This vulnerability represents a direct violation of CWE-22 Path Traversal and falls under the broader category of CWE-434 Unrestricted Upload of File with Dangerous Type, as it allows unauthorized file manipulation within the application's file system. The vulnerability is particularly concerning because it requires only authenticated access, meaning any user with valid credentials can exploit this flaw to execute arbitrary file deletion commands.
The technical exploitation occurs when an attacker modifies the existing_image field during category updates to include malicious path traversal sequences such as ../ or ..\ that bypass normal file system restrictions. When the Image::delete() method processes these inputs without proper sanitization, it executes the deletion command against the specified file paths, potentially targeting critical system files including the database.php configuration file that contains database connection credentials and application settings. This particular vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter and T1486 Data Encrypted for Impact, as it enables attackers to compromise the application's core configuration files and potentially disrupt service availability.
The operational impact of this vulnerability is severe as it allows attackers to effectively disable the installation gate mechanism by deleting the database.php file, which forces the application to redirect users to the public setup wizard. This redirection creates a critical security boundary violation where unauthorized individuals can create new superadmin accounts with full administrative privileges over the entire phpMyFAQ installation. The attack chain demonstrates how a single path traversal vulnerability can escalate to full system compromise through the exploitation of configuration file deletion capabilities. This type of vulnerability is particularly dangerous in environments where phpMyFAQ serves as a database management interface for sensitive information systems, as it provides a direct pathway to administrative control without requiring additional authentication factors.
The recommended mitigations include implementing comprehensive input validation and sanitization for all user-supplied paths, particularly those used in file system operations. Organizations should immediately upgrade to phpMyFAQ version 4.1.6 or later where this vulnerability has been addressed through proper path validation mechanisms. Additionally, the application should implement strict file access controls that prevent deletion of critical configuration files, and all file operations should be performed within designated safe directories with appropriate permission restrictions. Network segmentation and monitoring for unusual file deletion patterns can help detect exploitation attempts, while regular security audits should verify that no unauthorized modifications have occurred to the application's core files or directory structures.