thorsten phpMyFAQ up to 4.1.3 Attachment Password weak hash

Summaryinfo

A vulnerability was found in thorsten phpMyFAQ up to 4.1.3. It has been classified as problematic. This impacts an unknown function of the component Attachment Password Handler. Performing a manipulation results in weak hash. This vulnerability was named CVE-2026-48488. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in thorsten phpMyFAQ up to 4.1.3. It has been classified as problematic. This affects an unknown code block of the component Attachment Password Handler. The manipulation with an unknown input leads to a weak hash vulnerability. CWE is classifying the issue as CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). This is going to have an impact on confidentiality. The summary by CVE is:

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-48488 since 05/21/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 4.1.4 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• thorsten

Name

• phpMyFAQ

Version

• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3

License

• open-source

Website

• Product: https://github.com/thorsten/phpMyFAQ/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion