CVE-2026-66397: phpMyFAQ Path Traversal Vulnerability

CVE-2026-66397 Overview

CVE-2026-66397 is a path traversal vulnerability [CWE-22] in phpMyFAQ versions before 4.1.6. The flaw resides in the category update workflow, where the existing_image field is not validated for directory traversal sequences. Authenticated attackers can supply crafted paths to Image::delete() and remove arbitrary files on the host filesystem.

Deleting the database.php configuration file disables the installation gate. This exposes the public setup wizard, allowing an attacker to create a new superadmin account and take full control of the application.

Critical Impact
Authenticated attackers can escalate to superadmin by deleting the phpMyFAQ configuration file and abusing the exposed setup wizard.

Affected Products

phpMyFAQ versions prior to 4.1.6
Self-hosted phpMyFAQ deployments exposing authenticated admin endpoints
Multi-user phpMyFAQ instances where low-privilege editors can manage categories

Discovery Timeline

2026-07-27 - CVE-2026-66397 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66397

Vulnerability Analysis

phpMyFAQ allows administrators to associate images with FAQ categories. When a category is updated, the previous image reference is submitted through the existing_image field. The application passes this value to Image::delete() without validating that the path stays within the intended image directory.

Because traversal sequences such as ../ are not stripped or rejected, the delete routine resolves outside its expected base directory. Any file readable and writable by the web server process becomes a deletion target. The impact chain extends beyond simple file loss: removing database.php causes phpMyFAQ to treat the instance as uninitialized.

Once the installation gate is bypassed, the public /setup/ wizard becomes reachable without authentication. An attacker completes the wizard, points it at the existing database, and provisions a fresh superadmin account. This yields full administrative control, including the ability to execute further attacks against stored content and integrated services.

Root Cause

The root cause is missing input validation on the existing_image parameter during category updates. Image::delete() trusts the caller-supplied path and does not canonicalize or constrain it to the images directory. This is a classic path traversal weakness tracked under CWE-22.

Attack Vector

Exploitation requires an authenticated session with permission to edit categories. The attacker submits a category update request with existing_image set to a traversal string that resolves to config/database.php or another sensitive file. After deletion, the attacker requests the setup wizard, reconfigures the instance, and creates a superadmin. Details are documented in the GitHub Security Advisory GHSA-mh9w-5hr8-3272 and the VulnCheck advisory.

// No verified public exploit code is available.
// See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-66397

Indicators of Compromise

Missing or recently deleted config/database.php on the phpMyFAQ host
Unexpected access to /setup/ or /install/ endpoints after the initial deployment
Creation of new superadmin accounts outside change-management windows
Category update requests containing ../ sequences in the existing_image parameter

Detection Strategies

Inspect web server access logs for POST requests to category update endpoints with traversal patterns in form fields
Alert on any HTTP request to phpMyFAQ setup or install paths on a production instance
Monitor file integrity for config/database.php and other files under the phpMyFAQ root
Correlate admin account creation events with preceding requests to setup routes

Monitoring Recommendations

Enable verbose application logging for phpMyFAQ administrative actions, including category edits
Ship web and application logs to a centralized analytics platform for query and alerting
Baseline the set of superadmin accounts and alert on additions
Track file deletions within the phpMyFAQ document root using host-based file integrity monitoring

How to Mitigate CVE-2026-66397

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.6 or later without delay
Audit the phpMyFAQ document root to confirm config/database.php is present and unmodified
Review the list of superadmin accounts and remove any that were not provisioned by administrators
Restrict access to admin endpoints to trusted networks where feasible

Patch Information

The phpMyFAQ maintainers fixed the issue in version 4.1.6 by validating the existing_image value before it reaches Image::delete(). Refer to the GitHub Security Advisory GHSA-mh9w-5hr8-3272 for the fix commit and release notes.

Workarounds

Block HTTP requests to /setup/ and /install/ at the reverse proxy or web server layer on production instances
Enforce least privilege on category management to reduce the pool of accounts capable of exploiting the flaw
Configure the web server user with the minimum filesystem permissions required, denying write access to configuration files where possible

bash

# Example nginx rule to block access to setup routes in production
location ~* ^/(setup|install)/ {
    deny all;
    return 404;
}