CVE-2026-66398 Details
Description
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.
A remote code execution vulnerability has been identified in phpMyFAQ versions through 4.1.5 and 4.2.0-alpha. This vulnerability resides in the configuration API, allowing authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files. The issue arises from the updaters trust in the 'upgrade.lastDownloadedPackage' setting, which can be manipulated to execute malicious code as the web server user. Exploitation involves uploading a ZIP file containing a PHP payload as an attachment, directing the updater to the files location, and extracting it into the application root.
Users are advised to update phpMyFAQ to version 4.1.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 27, 2026CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4fv7-8rr6-rf2w | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4fv7-8rr6-rf2w | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-before-remote-code-execution-via-configuration-api | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-494 | Download of Code Without Integrity Check | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | <= 4.1.5 (semver) 4.2.0-alpha (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |