CVE-2026-57961: phpMyFAQ Path Traversal Vulnerability

CVE-2026-57961 Overview

CVE-2026-57961 is an authenticated path traversal vulnerability in phpMyFAQ versions before 4.1.5. The flaw resides in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML that references crafted image paths. During PDF generation, these paths are resolved and passed to file_get_contents() without canonicalization. This can allow the attacker to read files outside the intended content directory. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated editors can read arbitrary files accessible to the web server process, potentially exposing configuration files, credentials, and application secrets during PDF export operations.

Affected Products

phpMyFAQ versions prior to 4.1.5
Deployments exposing FAQ editing privileges to untrusted users
Installations using the PDF export feature

Discovery Timeline

2026-07-10 - CVE-2026-57961 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-57961

Vulnerability Analysis

The vulnerability originates in the path resolution logic used by phpMyFAQ's PDF export component. When rendering FAQ content into a PDF, the wrapper processes image references embedded in stored HTML. The concatenatePaths() function attempts to locate the substring content inside a user-supplied path using PHP's strpos(). The result is then used to construct a filesystem path handed to file_get_contents().

Because the export runs server-side with the privileges of the phpMyFAQ process, any file readable by the web server becomes a potential disclosure target. The attacker only requires FAQ editing permissions and the ability to trigger a PDF export of the poisoned content.

Root Cause

The defect is a type-juggling error compounded by missing path containment checks. PHP's strpos() returns false when the needle is absent, and false is coerced to 0 when cast to an integer. The code path treats this 0 as a valid offset, preserving the entire attacker-controlled path rather than trimming it relative to the content directory. The resulting string is not canonicalized with realpath() and is not validated to remain within the intended content root before being passed to file_get_contents().

Attack Vector

Exploitation requires an authenticated account with FAQ editing rights. The attacker stores an FAQ entry containing HTML with a crafted img reference that omits the content marker and instead uses traversal sequences pointing to sensitive files. When the FAQ is exported to PDF, the wrapper resolves the path through the vulnerable logic and reads the referenced file. The file contents may then surface in the generated PDF output.

No verified public exploit code is available at time of writing. Refer to the GitHub Security Advisory GHSA-88g4-74f3-63x9 and the VulnCheck Advisory for full technical context.

Detection Methods for CVE-2026-57961

Indicators of Compromise

FAQ entries containing HTML img tags with path traversal sequences such as ../, absolute filesystem paths, or references that omit the expected content directory segment.
PDF export requests immediately following edits to FAQ content by non-administrative accounts.
Web server access logs showing repeated PDF export calls targeting the same FAQ ID from a single session.

Detection Strategies

Audit stored FAQ HTML for image src attributes referencing paths outside the configured content directory.
Correlate FAQ edit events with subsequent PDF export requests to flag anomalous read patterns.
Instrument file_get_contents() calls at the application layer with logging of the resolved absolute path.

Monitoring Recommendations

Monitor the phpMyFAQ application user table for newly created editor accounts and privilege changes.
Alert on filesystem access from the web server process to sensitive paths such as /etc/passwd, .env, or application configuration files.
Track PDF export volume per user and investigate spikes from accounts that do not typically perform exports.

How to Mitigate CVE-2026-57961

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.5 or later, which contains the patched concatenatePaths() logic.
Review all accounts with FAQ editing privileges and revoke access for users who no longer require it.
Audit stored FAQ content for suspicious img references before applying the patch to prevent triggering the flaw during a legitimate export.

Patch Information

The maintainers addressed the issue in phpMyFAQ 4.1.5. Details of the fix are published in the GitHub Security Advisory GHSA-88g4-74f3-63x9. Administrators should apply the upstream release rather than backporting individual commits to ensure all related hardening is included.

Workarounds

Restrict FAQ editing privileges to trusted administrators until the patch is applied.
Disable the PDF export feature if it is not required by end users.
Run the phpMyFAQ process under a dedicated low-privilege system account with filesystem access limited to the application's content directory.

bash

# Verify installed phpMyFAQ version and upgrade
grep -R "VERSION" /var/www/phpmyfaq/config/constants.php
# Then upgrade to 4.1.5 or later per the official upgrade guide