CVE-2026-57961 PUBLISHED

phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function

Assigner: VulnCheck
Reserved: 26.06.2026 Published: 10.07.2026 Updated: 10.07.2026

phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring "content" within a user-controlled path using strpos(); when "content" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the entire attacker-controlled path. This path is later passed to file_get_contents() without canonicalization or root-directory containment validation, which may allow reading of files outside the intended content directory.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.1

Product Status

Vendor phpMyFAQ
Product phpMyFAQ
Versions Default: unaffected
  • affected from 0 to 4.1.5 (excl.)
  • Version 4.1.5 is unaffected

Credits

  • DomainXTech reporter

References

Problem Types

  • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE