CVE-2026-34728 Details
Description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload directory path without any path traversal validation. The FILTER_SANITIZE_SPECIAL_CHARS filter only encodes HTML special characters (&, ', ", <, >) and characters with ASCII value < 32, and does not prevent directory traversal sequences like ../. Additionally, the endpoint does not validate CSRF tokens, making it exploitable via CSRF attacks. This issue has been patched in version 4.1.1.
A path traversal vulnerability has been identified in phpMyFAQ versions prior to 4.1.1, specifically within the MediaBrowserController::index() method. This vulnerability allows for arbitrary file deletion via the fileRemove action. The issue arises because user-supplied input is not properly sanitized to prevent directory traversal, enabling the deletion of files outside the intended directory. Additionally, the endpoint lacks Cross-Site Request Forgery (CSRF) protection, further exacerbating the issue.
Users are advised to update to phpMyFAQ version 4.1.1 or later, where this vulnerability has been patched. In addition, the MediaBrowserController should be modified to include proper path traversal validation, add CSRF protection, and change the HTTP method to POST or DELETE to align with proper HTTP semantics.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38x | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1 | [email protected] | Product |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38x | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpmyfaq phpmyfaq | < 4.1.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | New CVE Received | [email protected] |