CVE-2026-34728: phpMyFAQ Path Traversal Vulnerability

CVE-2026-34728 Overview

CVE-2026-34728 is a high-severity path traversal vulnerability combined with a Cross-Site Request Forgery (CSRF) weakness in phpMyFAQ, an open source FAQ web application. The vulnerability exists in the MediaBrowserController::index() method, which handles file deletion for the media browser. When the fileRemove action is triggered, user-supplied input via the name parameter is concatenated with the base upload directory path without any path traversal validation. This allows authenticated attackers to delete arbitrary files on the server by injecting directory traversal sequences such as ../.

Critical Impact

Attackers can exploit this vulnerability to delete critical system files or application configuration files, leading to denial of service or potential complete system compromise. The additional lack of CSRF token validation enables this attack to be triggered via malicious links or pages without user interaction.

Affected Products

• phpMyFAQ versions prior to 4.1.1

Discovery Timeline

• 2026-04-02 - CVE-2026-34728 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34728

Vulnerability Analysis

The vulnerability resides in the media browser file deletion functionality of phpMyFAQ. The MediaBrowserController::index() method processes file deletion requests but fails to properly sanitize user-supplied file path input. While the application applies FILTER_SANITIZE_SPECIAL_CHARS to the name parameter, this filter only encodes HTML special characters (&, ', ", <, >) and characters with ASCII values less than 32. Critically, this sanitization does not prevent directory traversal sequences like ../ from being processed.

Furthermore, the endpoint lacks CSRF token validation, meaning an attacker can craft a malicious webpage or email link that, when visited by an authenticated phpMyFAQ administrator, will trigger arbitrary file deletion on the server without the user's knowledge or consent.

Root Cause

The root cause is twofold: improper input validation (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) and missing CSRF protection. The application incorrectly assumes that FILTER_SANITIZE_SPECIAL_CHARS provides sufficient protection against path manipulation attacks when this filter was designed solely for preventing HTML injection, not directory traversal. The combination of these weaknesses significantly amplifies the attack surface.

Attack Vector

The attack is network-based and requires low privileges (authenticated user) with some user interaction. An attacker with valid credentials can directly exploit the path traversal to delete files outside the intended upload directory. Alternatively, an external attacker can leverage the CSRF weakness by tricking an authenticated administrator into visiting a malicious page that automatically submits a crafted file deletion request. The attack can potentially affect resources beyond the vulnerable application's security scope, enabling deletion of files across the server filesystem that the web server process has write access to.

The vulnerability can be exploited by submitting a crafted name parameter containing path traversal sequences (e.g., ../../../etc/passwd or ../../config/database.php) to the media browser's fileRemove action endpoint. For technical details, refer to the GitHub Security Advisory GHSA-38m8-xrfj-v38x.

Detection Methods for CVE-2026-34728

Indicators of Compromise

• HTTP requests to the media browser endpoint containing ../ sequences in the name parameter
• Unexpected file deletions in web server directories or system paths
• Web server access logs showing fileRemove action requests with encoded path traversal characters (%2e%2e%2f)
• Missing critical configuration files or application components

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block requests containing path traversal patterns (../, ..%2f, %2e%2e/, etc.)
• Monitor HTTP request logs for anomalous name parameter values in requests to the media browser controller
• Implement file integrity monitoring (FIM) on critical system and application directories
• Review authentication logs for unusual activity patterns from legitimate admin accounts that may indicate CSRF exploitation

Monitoring Recommendations

• Enable verbose logging for the phpMyFAQ application to capture all file operations
• Set up real-time alerts for file deletion events outside the designated upload directory
• Monitor for Referer headers indicating requests originating from external domains (potential CSRF attacks)
• Implement anomaly detection for file system changes in protected directories

How to Mitigate CVE-2026-34728

Immediate Actions Required

• Upgrade phpMyFAQ to version 4.1.1 or later immediately
• Review web server and application logs for evidence of exploitation attempts
• Verify the integrity of critical system and application files
• Implement additional access controls to restrict administrative functionality to trusted IP ranges

Patch Information

The vulnerability has been patched in phpMyFAQ version 4.1.1. The fix implements proper path traversal validation and adds CSRF token verification to the media browser file deletion endpoint. Users should upgrade immediately by downloading the latest release from the official phpMyFAQ GitHub releases page.

Workarounds

• Restrict access to the phpMyFAQ admin panel via network-level controls (firewall rules, VPN requirements)
• Implement WAF rules to block requests containing path traversal sequences targeting the media browser endpoint
• Disable the media browser functionality if not required for operations
• Run the web server process with minimal filesystem permissions to limit the impact of arbitrary file deletion

# Example: Restrict admin panel access by IP in Apache
<Directory "/var/www/html/phpmyfaq/admin">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Directory>