CVE Catalog
CVE-2026-48488
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk0.18%
8th percentile - higher than 8% of all known CVEs
Summary
phpMyFAQ prior to version 4.1.4 uses SHA-1 for hashing attachment passwords. SHA-1 is cryptographically broken and vulnerable to collision attacks since 2017.
Risk Assessment
The risk involves potential recovery of attachment passwords by an attacker, leading to unauthorized access to protected files.
Recommendation
Update phpMyFAQ to version 4.1.4 or later, which uses a more secure hashing algorithm.
Original NVD description (English source)
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.