CVE-2026-66398
CRITICALphpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
Title source: cnaDescription
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-4fv7-8rr6-rf2w)
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4fv7-8rr6-rf2w
Third Party Advisory third-party-advisory
VulnCheck Advisory: phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
https://www.vulncheck.com/advisories/phpmyfaq-before-remote-code-execution-via-configuration-api
Scores
CVSS v4
9.4
EPSS
0.0024
EPSS Percentile
15.4%
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-494
Status
published
Products (2)
thorsten/phpMyFAQ
< 4.1.6
thorsten/phpMyFAQ
4.1.6
Published
Jul 27, 2026
Tracked Since
Jul 27, 2026