CVE-2026-34728
When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload directory path without any path traversal validation.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload directory path without any path traversal validation. The FILTER_SANITIZE_SPECIAL_CHARS filter only encodes HTML special characters (&, ', ", <, >) and characters with ASCII value < 32, and does not prevent directory traversal sequences like ../. Additionally, the endpoint does not validate CSRF tokens, making it exploitable via CSRF attacks. This issue has been patched in version 4.1.1.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 0.69% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- phpmyfaq/phpmyfaq
- Source
- security-advisories@github.com
References
- https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1Product
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38xExploit, Mitigation, Vendor Advisory
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38xExploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.