CVE-2026-57961
LowCVSS 2.7Summary
phpMyFAQ before version 4.1.5 contains a path traversal vulnerability in the concatenatePaths() function in Wrapper.php. An authenticated user with FAQ editing privileges can store crafted HTML with image paths that are processed during PDF generation. Lack of path canonicalization and root-directory containment validation may allow reading files outside the intended content directory.
Risk Assessment
The risk involves potential reading of sensitive system files by an authenticated user with FAQ editor privileges, which could lead to data leakage or attack escalation.
Recommendation
Immediately update phpMyFAQ to version 4.1.5 or later, which includes a fix for this vulnerability. Additionally, restrict FAQ editing privileges to trusted users only.
Original NVD description (English source)
phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring "content" within a user-controlled path using strpos(); when "content" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the entire attacker-controlled path. This path is later passed to file_get_contents() without canonicalization or root-directory containment validation, which may allow reading of files outside the intended content directory.