CVE-2026-45008: phpMyFAQ Path Traversal Vulnerability

CVE-2026-45008 Overview

CVE-2026-45008 is a path traversal vulnerability in phpMyFAQ versions before 4.1.2. The flaw resides in the Client::deleteClientFolder method, which fails to validate the url parameter before performing recursive directory deletion. Administrators holding the INSTANCE_DELETE permission can submit crafted traversal sequences such as https://../../../<path> to escape the intended clientFolder scope. The result is arbitrary directory deletion anywhere the web server process has write access. The issue is tracked as CWE-73: External Control of File Name or Path.

Critical Impact
Authenticated administrators can recursively delete arbitrary directories on the host filesystem, causing data loss and denial of service for the phpMyFAQ application and any colocated files.

Affected Products

phpMyFAQ versions prior to 4.1.2
phpMyFAQ Client instance management component
Deployments exposing the admin instance interface to users with INSTANCE_DELETE permission

Discovery Timeline

2026-05-15 - CVE-2026-45008 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45008

Vulnerability Analysis

The vulnerability exists in phpMyFAQ's multi-client (instance) management logic. When an administrator deletes a client instance, the application calls Client::deleteClientFolder, which derives a filesystem path from the user-supplied url parameter associated with the instance. The method then performs a recursive directory removal on that derived path.

The url value is not normalized or constrained to the intended clientFolder base directory. An attacker who controls the url field can embed ../ sequences after the scheme, for example https://../../../var/www/html/config. When the path is constructed and passed to the recursive delete routine, traversal occurs and files outside the application's client directory are removed.

Exploitation requires high privileges, since only administrators with INSTANCE_DELETE can reach the code path. Compromise of an admin account, insider abuse, or chaining with a separate authentication bypass therefore unlocks broad filesystem destruction.

Root Cause

The root cause is missing input validation and path canonicalization on the url parameter before it is used to construct a filesystem path. The code trusts that the stored client URL maps cleanly to a subdirectory of clientFolder, but never enforces that constraint with a realpath check or a prefix comparison against the base directory.

Attack Vector

An authenticated administrator submits or modifies a client instance so that its url field contains traversal sequences. Triggering the delete action invokes Client::deleteClientFolder, which resolves the malicious path and recursively unlinks the target directory. The attack is performed over the network through the standard phpMyFAQ admin interface. Refer to the GitHub Security Advisory GHSA-gh9p-q46p-57g2 and the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-45008

Indicators of Compromise

Client instance records in the phpMyFAQ database where the url column contains ../, ..\, or scheme-prefixed traversal patterns such as https://../.
Web server access log entries to admin endpoints for client deletion immediately followed by missing directories or files outside clientFolder.
Unexpected rmdir or unlink syscalls originating from the PHP-FPM or Apache worker process targeting paths outside the application root.

Detection Strategies

Audit the phpMyFAQ instance table for any client url values that do not parse to a clean hostname plus path, and flag entries containing .. segments.
Enable PHP error and audit logging around Client::deleteClientFolder invocations to capture the resolved target path before deletion.
Compare filesystem state against backups to detect deletions that occurred outside the expected clientFolder subtree.

Monitoring Recommendations

Forward web server and PHP application logs to a centralized analytics platform and alert on admin requests to instance delete routes.
Monitor file integrity on directories adjacent to the phpMyFAQ install, including config, attachments, and parent web roots.
Track administrative session activity and correlate INSTANCE_DELETE actions with the principal performing them for after-the-fact attribution.

How to Mitigate CVE-2026-45008

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.2 or later, which adds path validation in Client::deleteClientFolder.
Review and minimize the set of administrators granted the INSTANCE_DELETE permission.
Rotate administrator credentials and audit recent client deletion events for evidence of abuse.

Patch Information

The maintainers fixed the issue in phpMyFAQ 4.1.2. The patched code validates that the resolved deletion target remains within the configured clientFolder base path before performing recursive removal. Refer to the GitHub Security Advisory GHSA-gh9p-q46p-57g2 for the official fix commit and release notes.

Workarounds

Restrict access to the phpMyFAQ admin interface using network controls such as IP allowlists or a VPN until the patch is applied.
Remove the INSTANCE_DELETE permission from non-essential administrator roles to reduce the attacker population.
Run the PHP process under a least-privileged user account that cannot write outside the application directory, limiting blast radius of arbitrary deletes.

bash

# Configuration example: confirm installed phpMyFAQ version and upgrade
grep -R "VERSION" /var/www/phpmyfaq/inc/PMF/ | head
composer require phpmyfaq/phpmyfaq:^4.1.2